Overview

overview

10

Static

static

1

8500c39508...18.exe

windows7-x64

10

8500c39508...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8500c39508fe630ae0295ecf59330550_JaffaCakes118

  • Size

    729KB

  • Sample

    240530-wnmy7aff3s

  • MD5

    8500c39508fe630ae0295ecf59330550

  • SHA1

    47529bf0f19a68856fba35c56e34ab19125da4a5

  • SHA256

    c22d5da8c6f9ca4592e1aecd967a95c479c7d0a15e65606ca1d3d6c01ac550c6

  • SHA512

    6890c3b4976cab879101336d1ff165b3509cb04644d330feb677344cdf48162dc4d0ffed4d6c473e99c06b1efade5e799d157ad4b67ed9a61e9d87cd3b9713eb

  • SSDEEP

    12288:HLZGxCemTW1m24nS32rVZwusk1ErPTzbE+m+N+fk5xbzH:rZIq2xmZYyEr7U+fNE2bD

Score
10/10
imminentspywaretrojan

Malware Config

Targets

    • Target

      8500c39508fe630ae0295ecf59330550_JaffaCakes118

    • Size

      729KB

    • MD5

      8500c39508fe630ae0295ecf59330550

    • SHA1

      47529bf0f19a68856fba35c56e34ab19125da4a5

    • SHA256

      c22d5da8c6f9ca4592e1aecd967a95c479c7d0a15e65606ca1d3d6c01ac550c6

    • SHA512

      6890c3b4976cab879101336d1ff165b3509cb04644d330feb677344cdf48162dc4d0ffed4d6c473e99c06b1efade5e799d157ad4b67ed9a61e9d87cd3b9713eb

    • SSDEEP

      12288:HLZGxCemTW1m24nS32rVZwusk1ErPTzbE+m+N+fk5xbzH:rZIq2xmZYyEr7U+fNE2bD

    Score
    10/10
    imminentspywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks