imminent | 3c3557d4bcad650d784053c1b8cb81e94045a5c9bfca6c2c4af2546b353589e0

General

Target
JaffaCakes118_3a4603408b7f9cf81b35e35098333d47
Size 651KB
Sample251218-18s36ayman
SHA256 3c3557d4bcad650d784053c1b8cb81e94045a5c9bfca6c2c4af2546b353589e0
MD5 3a4603408b7f9cf81b35e35098333d47
SHA1 f78f6215dea5ecb2168b9b122e976e4a936a6ea0
SHA512 5ba5bd6ace28cbdd8bb56c3f6b8490110ef903f8aae39583bb36195095796d429e6ed238971a6ad9fc8b25ee2a9f563ddb0a4c902f4ede5f4ecd1d626c0c17e9
SSDEEP 12288:7xei9ukSX5ft0oVNRmqDUaczTvRNx8EZeLpROLy4d9qQRW0r59g5g1bk:tdsVSoIaJcnvREpR9on19g5g
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  JaffaCakes118_3a4603408b7f9cf81b35e35098333d47
- Size 651KB
- SHA256 3c3557d4bcad650d784053c1b8cb81e94045a5c9bfca6c2c4af2546b353589e0
- MD5 3a4603408b7f9cf81b35e35098333d47
- SHA1 f78f6215dea5ecb2168b9b122e976e4a936a6ea0
- SHA512 5ba5bd6ace28cbdd8bb56c3f6b8490110ef903f8aae39583bb36195095796d429e6ed238971a6ad9fc8b25ee2a9f563ddb0a4c902f4ede5f4ecd1d626c0c17e9
- SSDEEP 12288:7xei9ukSX5ft0oVNRmqDUaczTvRNx8EZeLpROLy4d9qQRW0r59g5g1bk:tdsVSoIaJcnvREpR9on19g5g
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agilenet discovery imminent spyware trojan
- Imminent RAT
  Remote-access trojan based on Imminent Monitor remote admin software.
  trojan spyware imminent
- Imminent family
  imminent
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Drops desktop.ini file(s)
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Imminent RAT

Imminent family

Checks computer location settings

Drops startup file

Obfuscated with Agile.Net obfuscator

Drops desktop.ini file(s)

SmartAssembly .NET packer

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2