Overview

overview

10

Static

static

3

keygen.exe

windows7-x64

10

keygen.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_4179a34e3714bdd5e5a7a7997ed274d0

  • Size

    390KB

  • Sample

    250101-bbkyvaylax

  • MD5

    4179a34e3714bdd5e5a7a7997ed274d0

  • SHA1

    013d1f8458340e39383aab8f2451287900a70526

  • SHA256

    be3872f17627f62461efd89de2d0a098767479f989352f6e4d373c449ee0db31

  • SHA512

    153a41bbb27d4379bf7a42ecc0fc6275f4d08e10e666cddf26409d4562271d5eacc107360360783160b8c56eb3e4e3a135ec50fd4d657748df3e309ec2e75091

  • SSDEEP

    6144:cnKMo5a+zGED7mt2hM826R51UMyKYsihFrXU8OQIT7c4bm02JonTLYdW83Mwfkpn:ioY+/DadQMMyuiKQuc4iaTLXfFn

Score
10/10
imminentdefense_evasiondiscoverypersistencespywaretrojan

Malware Config

Targets

    • Target

      keygen.exe

    • Size

      474KB

    • MD5

      c1cfbe3462978d8fee8b0ad881d88766

    • SHA1

      b501ac3965b05b2e7362274ab0b7be2a543b02c9

    • SHA256

      ec5116beddb3fbf853920fa28fdd5b190818b3c6ee7385c1871a4c9512e9eab9

    • SHA512

      00b55b0d3bac872e123134fb83ff294b6cdc638d4a8e8ab24d04d42085f4c1aebe79108a9be6e46c6f17d42310bf266a7b0dc41fa8e3308ecc27764374064780

    • SSDEEP

      12288:9pUEpygn7dfjcP+1PhW/+0/+OGCgiRQVaaeFn:3AqpfjSiyx/+J8aeF

    Score
    10/10
    imminentdefense_evasiondiscoverypersistencespywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Imminent family

      imminent

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks