MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b94b4f8b8f3276f8c41a035a5963d8251c587be6c9fa9e6eb51d8839f51cc69. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ImminentRAT


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b94b4f8b8f3276f8c41a035a5963d8251c587be6c9fa9e6eb51d8839f51cc69
SHA3-384 hash: 7fe18d5f6ea2ab5d470fcb40eec88f0c7a44f730d737e2498f78560cb8e2cfddb2d26347294ed5757835330ebdf8c96a
SHA1 hash: 70502312541d40c28576fc5b9a79262e31c21bd4
MD5 hash: 90393b62689a0c1a33733212e008ff99
humanhash: virginia-steak-bakerloo-mike
File name:CLVIEW.exe
Download: download sample
Signature ImminentRAT
Create hunting rule
File size:952'320 bytes
First seen:2020-04-30 07:28:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:0peahu9cM+A2d6Rk4Cp+CKFHeSJ7zdGxp3cGl:y3hu9dI+CoCKNeSJ7zdGf3
TLSH 9915D52A671AC8BEDF1F2F7049B89D8A92B96CD31C0ACF769247C31B2B505CD751112B
Reporter jarumlus
Tags:ImminentRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.32119949.27074.20013.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2019-07-05 10:54:54 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
23 of 31 (74.19%)
Threat level:
  2/5
Verdict:
unknown
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ImminentRAT

Executable exe 2b94b4f8b8f3276f8c41a035a5963d8251c587be6c9fa9e6eb51d8839f51cc69

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/199182/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments