Overview

overview

10

Static

static

3

15612126b4...18.exe

windows7-x64

10

15612126b4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15612126b4dea86af4cc2dc8fb551090_JaffaCakes118

  • Size

    556KB

  • Sample

    240505-bxrnhsad6w

  • MD5

    15612126b4dea86af4cc2dc8fb551090

  • SHA1

    4046ae82ecbb9e8549896cc39bf783905a8b2007

  • SHA256

    1b8665fdd88f4b34660a541d63875b1a50da6813580e28b4eaa8f3239f5645e3

  • SHA512

    f06a5e86214b6459b9eded15cc10b9e7ed0c2e57b30381d5f8d87a42fb479c77713ad88a05f2f7991d506fb28d1bcc3e1336f25c770472515d7d44b875cde6fe

  • SSDEEP

    12288:qpM78IYYQcUpRzkh2ktYMPTHO+PZZKqky26:ZZYYQ5khDtYMTOOZZ1

Score
10/10
imminentspywaretrojan

Malware Config

Targets

    • Target

      15612126b4dea86af4cc2dc8fb551090_JaffaCakes118

    • Size

      556KB

    • MD5

      15612126b4dea86af4cc2dc8fb551090

    • SHA1

      4046ae82ecbb9e8549896cc39bf783905a8b2007

    • SHA256

      1b8665fdd88f4b34660a541d63875b1a50da6813580e28b4eaa8f3239f5645e3

    • SHA512

      f06a5e86214b6459b9eded15cc10b9e7ed0c2e57b30381d5f8d87a42fb479c77713ad88a05f2f7991d506fb28d1bcc3e1336f25c770472515d7d44b875cde6fe

    • SSDEEP

      12288:qpM78IYYQcUpRzkh2ktYMPTHO+PZZKqky26:ZZYYQ5khDtYMTOOZZ1

    Score
    10/10
    imminentspywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks