Overview

overview

10

Static

static

891ee3061e...ff.exe

windows7-x64

10

891ee3061e...ff.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    891ee3061ee23dd04daf031e3c5e5efdbf852def4bc05126a5deafd797912eff

  • Size

    321KB

  • Sample

    221125-v3m23afg71

  • MD5

    e7b3076df23c41b827181a3e0ae332c2

  • SHA1

    8bb243da0136ec6b37f5643b200fe00f73f6dcc6

  • SHA256

    891ee3061ee23dd04daf031e3c5e5efdbf852def4bc05126a5deafd797912eff

  • SHA512

    b68c93e1824592fc6a1395947f20624e8f6c953e07eba83fe2200a8f41cfd964c8776a78affeaeb4f85475772cf2c6604b6f1f2a6f61f410e4c95a8030f28dad

  • SSDEEP

    6144:v9vpsmGL4qibH3Lk7DkDRHBg186rdLE+ADoaPxI0:vn7GOviDklHBotdLyU+I

Score
10/10
imminentpersistencespywaretrojan

Malware Config

Targets

    • Target

      891ee3061ee23dd04daf031e3c5e5efdbf852def4bc05126a5deafd797912eff

    • Size

      321KB

    • MD5

      e7b3076df23c41b827181a3e0ae332c2

    • SHA1

      8bb243da0136ec6b37f5643b200fe00f73f6dcc6

    • SHA256

      891ee3061ee23dd04daf031e3c5e5efdbf852def4bc05126a5deafd797912eff

    • SHA512

      b68c93e1824592fc6a1395947f20624e8f6c953e07eba83fe2200a8f41cfd964c8776a78affeaeb4f85475772cf2c6604b6f1f2a6f61f410e4c95a8030f28dad

    • SSDEEP

      6144:v9vpsmGL4qibH3Lk7DkDRHBg186rdLE+ADoaPxI0:vn7GOviDklHBotdLyU+I

    Score
    10/10
    imminentpersistencespywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks