Overview

overview

10

Static

static

3

CrypteX Ad...ed.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1e281q.rar

  • Size

    2.8MB

  • Sample

    230604-2vejaaea63

  • MD5

    695e17014aee1695e4e4b08558098bb6

  • SHA1

    b16ae973b723e9c075e98285da5681304c80af6c

  • SHA256

    264b34d8521655d554f9f7e34b130d68a3d13f3d8230b40342c9d84fb95bef48

  • SHA512

    786edad911a28c8d86547782deff8fcbceca0515e1a6e21b5559729f5f5f9b9fb7ea127561022f592e6b8d65513fd28e96227818c43f8f89a2e623fe3e9f6178

  • SSDEEP

    49152:vQodxhkLLLigDDc4Zxio/Tyykr+B4c4UVyZ+XctvlKaCw:v3xhULWODacWNxcdyZ7dkw

Score
10/10
imminentpersistencespywaretrojan

Malware Config

Targets

    • Target

      CrypteX Advanced/CrypteX Advanced/CrypteX Advanced.exe

    • Size

      3.8MB

    • MD5

      a191e14057dc91c8922827b591ea594b

    • SHA1

      41e07a4170ac0b4f0d33880ff83ec22d9dfdf70a

    • SHA256

      1bdc804b2c9015f8480e43f918580a089b03aef0917607d24eec97aa8eadd3c5

    • SHA512

      243147396331a874a4473201f80f6a1b8a12dadb8e6f01e774d41a9ed50111dbf1c9faaabdf0f3c653987a89a0b51fc0d413618a1e12a0d042b0c330bfc5a143

    • SSDEEP

      49152:TtUECyX4kYTJPKgdWsBQrTq0+DeoMyx1fDGCKRIQ:TCECcyb7bKR/

    Score
    10/10
    imminentpersistencespywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks