GRIMAGENTMalware
GRIMAGENT is a backdoor that can execute arbitrary commands, download files, create and delete scheduled tasks, and execute programs via scheduled tasks or via the ShellExecute API. The malware persists via a randomly named scheduled task and a registry Run key.From MISP Galaxy
Last reported 5 years ago, by Group-IB1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1053.005Scheduled Task
“… we have shown throughout the article, to execute payloads GrimAgent uses both the ShellExecute call and indirect execution through scheduled tasks.”
- T1552.004Private Keys
“Generated client RSA public and private keys: Both stored at the config file.”
What the reports say
1 report, newest first · the exact sentence from each-
The Brothers Grim“The most recent addition to their arsenal, which is yet to be explored, is the malware called GrimAgent.”
Indicators in its reports
named in the reports above- 03ec9000b493c716…88c6a1c65ce5in 1 report
- 015e5a1fa9d8151ee51d6e53e187fbb2in 1 report
- 163917ced2d1b330…ec3ea871d517in 1 report
- 63bd614434a70599…a3c4b4db5cafin 1 report
- hxxps://github[.]com/apriegob/GrimAgent/blob/main/IDAPro/IDAPro_string_decryptor.pyin 1 report
- d6ee553f52f20127…73144ef2354din 1 report
- hxxp://ip-api[.]com/csv/?fields=query,countryCodein 1 report
- microsoftupdate[.]topin 1 report
- microsoftsystemcloud[.]comin 1 report
- chaseltd[.]topin 1 report
Copy these 10 indicators · defanged
Thanks — we review every report.