imminent | 1c0b71a3b014e37e8fcaf6246b511dbc7d8bc699a70df65a3a850e63f2c490bc | Triage

Sharing

General

Target

f935eb47643d5db4bc3408b59aa7ca51_JaffaCakes118
Size

329KB
Sample

240926-1h43qsyfrp
MD5

f935eb47643d5db4bc3408b59aa7ca51
SHA1

93c477c05afd2d880cba6490c7905a3ea3a91a33
SHA256

1c0b71a3b014e37e8fcaf6246b511dbc7d8bc699a70df65a3a850e63f2c490bc
SHA512

3a165f0f65bce2f5d3cf7ba3a6d5fcaec0b46e5456d42aed4038c785fd9eea5fb2c786976a8b1a6b8d72113f094123e2e44d0fdf4965cacc7b70f434ec7907be
SSDEEP

6144:rcMpXo/GH+qQccAbhIzezWvHv7DV+G7zFoAzMQv4HeypAudWVQ5bm:XpXo/GH+JccAbmKWvHzDV+RAzMbH9dZm

Score

10^/10

imminent discovery spyware trojan

Malware Config

Targets

- Target
  
  f935eb47643d5db4bc3408b59aa7ca51_JaffaCakes118
- Size
  
  329KB
- MD5
  
  f935eb47643d5db4bc3408b59aa7ca51
- SHA1
  
  93c477c05afd2d880cba6490c7905a3ea3a91a33
- SHA256
  
  1c0b71a3b014e37e8fcaf6246b511dbc7d8bc699a70df65a3a850e63f2c490bc
- SHA512
  
  3a165f0f65bce2f5d3cf7ba3a6d5fcaec0b46e5456d42aed4038c785fd9eea5fb2c786976a8b1a6b8d72113f094123e2e44d0fdf4965cacc7b70f434ec7907be
- SSDEEP
  
  6144:rcMpXo/GH+qQccAbhIzezWvHv7DV+G7zFoAzMQv4HeypAudWVQ5bm:XpXo/GH+JccAbmKWvHzDV+RAzMbH9dZm
Score

10^/10

imminent discovery spyware trojan
- Imminent RAT
  Remote-access trojan based on Imminent Monitor remote admin software.
  trojan spyware imminent
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

imminentdiscoveryspywaretrojan

behavioral2