MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d9a35e4493b187726d129d1406521a902daffc1f50a75ad022975a5b796505cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
ImminentRAT
Vendor detections: 13
| SHA256 hash: | d9a35e4493b187726d129d1406521a902daffc1f50a75ad022975a5b796505cd |
|---|---|
| SHA3-384 hash: | fcee8f976afd218f18b45728b9203e653a699b2f27d6c2eeae84c03933ea9c7d1f897afe1ddcd0fb6a42f710bdc1a0e3 |
| SHA1 hash: | 3cd4a821c82f388ece2b847af087c79868ea903b |
| MD5 hash: | 1bc52faf563eeda4207272d8c57f27cb |
| humanhash: | quiet-cola-burger-hydrogen |
| File name: | d9a35e4493b187726d129d1406521a902daffc1f50a75ad022975a5b796505cd |
| Download: | download sample |
| Signature | ImminentRAT |
| File size: | 923'648 bytes |
| First seen: | 2022-06-09 13:16:38 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 6144:+sObgrnx69AfwfXerpnW737BfTlwBQYenqVt/9Fob/ADKoQ32WZDrYm4AV9fcVQe:hObaBwsW7LtUQYeqV+CKrdVWPd4i |
| Threatray | 9'095 similar samples on MalwareBazaar |
| TLSH | T149155CA13652CC4CC96A05790426C0F0BD317EE56D94CA0E30DBFF6FBD33A8A6A2565D |
| TrID | 30.2% (.EXE) Win64 Executable (generic) (10523/12/4) 18.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 14.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 12.9% (.EXE) Win32 Executable (generic) (4505/5/1) 5.9% (.EXE) Win16/32 Executable Delphi generic (2072/23) |
| Reporter |  Tomer789123 |
| Tags: | Blind_Eagle exe ImminentRAT |
Intelligence
File Origin
# of uploads :
1
# of downloads :
283
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
d9a35e4493b187726d129d1406521a902daffc1f50a75ad022975a5b796505cd.exe
Verdict:
Suspicious activity
Analysis date:
2019-03-06 15:08:46 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Imminent
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
DNS request
Unauthorized injection to a recently created process
Creating a file
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed shell32.dll
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Gorgon Group
Verdict:
Malicious
Result
Threat name:
Imminent, AgentTesla
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to start a terminal service
Detected Imminent RAT
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Self deletion via cmd or bat file
Submitted sample is a known malware sample
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected AgentTesla
Yara detected Generic Downloader
Yara detected Imminent
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Infostealer.Hawket
Status:
Malicious
First seen:
2018-07-14 19:52:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
517
AV detection:
35 of 45 (77.78%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 9'085 additional samples on MalwareBazaar
Result
Malware family:
imminent
Score:
10/10
Tags:
family:imminent persistence spyware trojan
Behaviour
Runs ping.exe
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Deletes itself
Loads dropped DLL
Executes dropped EXE
Imminent RAT
Unpacked files
SH256 hash:
626ce8b60ebd7b06f1a63116cf773534bde340c70332ac2bb31588a398f1f859
MD5 hash:
5efba3c3e07f77620ee2ab1cd8f087cb
SHA1 hash:
f7437c26eda3fdc704c01a959d555a5eb287ee78
SH256 hash:
bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
MD5 hash:
0bd34aa29c7ea4181900797395a6da78
SHA1 hash:
ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8
SH256 hash:
666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
MD5 hash:
17ed442e8485ac3f7dc5b3c089654a61
SHA1 hash:
d3a17c1fdd6d54951141053f88bf8238dea0b937
SH256 hash:
baee7f0669b4c46110039f2d69a18b2f739669c257c9def875baf266dde372ae
MD5 hash:
01f32ae791553f65aec629901beb0240
SHA1 hash:
cc7e9944911511005a683406c11203c8df76512c
SH256 hash:
18092c6800d0013c18005169231ab848bc419a8c315706f88549741bfac420a9
MD5 hash:
c043cb0d54f437add1840d6f05bb365e
SHA1 hash:
771dac4352158cdf59ca318d3e49ce03cf237a78
SH256 hash:
0245467395e61c0e873612f38705e47a4b72acaaf0a3ba02ee65b20470488825
MD5 hash:
f93937b67a4a89ef91e122ddd30bb35c
SHA1 hash:
639378443c4d21130eecd653b9e3b18d8116a10a
SH256 hash:
e3631d584fdc0ec55cd8d4903858563a33bf44b77f332c359faf59b694429c8c
MD5 hash:
3cc1a209e342b77ff3df40eabaa66abf
SHA1 hash:
43dee40f8f3b1abec1efd583da6de105fcc3fcf5
SH256 hash:
a49815de19ade1d397265d489c1381a0496b01db32fb8376b55e142f35a8b965
MD5 hash:
a175b8650bff6e65b1da42dbae0860a0
SHA1 hash:
fd551a4c8794106e8e6be7c85ef202c2fae62c0d
SH256 hash:
763e4c02fe16e6d5fabb31e2850fb6dcb775826a104ab4e05286e8ba776e84c5
MD5 hash:
7a3861ee33eb174995381b26eb7e2e99
SHA1 hash:
7c2911abca6dd86ab0a68850350f4067df9e46b5
SH256 hash:
d9a35e4493b187726d129d1406521a902daffc1f50a75ad022975a5b796505cd
MD5 hash:
1bc52faf563eeda4207272d8c57f27cb
SHA1 hash:
3cd4a821c82f388ece2b847af087c79868ea903b
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.