Immirat

Overview

Backdoor:Win32/Immirat is a Remote Access Trojan (RAT) designed to provide an attacker with complete, stealthy, and persistent administrative control over a compromised Windows endpoint. It is frequently utilized in targeted espionage campaigns or by Initial Access Brokers (IABs) to establish a foothold before selling access to ransomware operators.

Understanding Immirat
To an end-user, an Immirat infection is entirely invisible, operating silently in the background. For a security analyst, a RAT represents a critical breach of the endpoint. Immirat is not an automated worm; it is a tool operated by a human adversary (hands-on-keyboard). The attacker uses the Immirat C2 server to issue real-time commands, browse the file system, exfiltrate data, and monitor the user's activities.

Execution and Remote Control Mechanics
Immirat is typically deployed via spearphishing campaigns containing weaponized attachments (`T1566.001`) or dropped by other initial access malware. Upon execution, it establishes persistence, often by creating a hidden scheduled task or installing itself as a Windows service (`T1543.003`). The RAT heavily obfuscates its executable (`T1027`) and often injects its core communication module into legitimate processes like `svchost.exe` (`T1055`) to evade EDR detection. Once active, Immirat opens a reverse shell or establishes an encrypted command channel (often over HTTPS or custom TCP protocols) back to the attacker's infrastructure (`T1105`). The attacker can then utilize built-in modules to log keystrokes (`T1056.001`), capture screenshots (`T1113`), activate the webcam, and exfiltrate sensitive files.

Indicators of Compromise & Impact
The impact is total endpoint compromise, data theft, and the high probability of lateral movement. EDR platforms must alert on anomalous child processes spawning from generic host processes, or the unauthorized creation of system services. Network logs will reveal sustained, long-lived connections (beaconing) to unknown, external IP addresses. Forensic analysis of the registry and Task Scheduler is required to uncover the persistence mechanisms.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.
• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.
• T1113: Monitor for frequent or unauthorized screen captures or clipboard reads. Restrict background applications from accessing desktop APIs.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_IMMIRAT {
    meta:
        description = "Detects Immirat (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "immirat" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Immirat Activity
id: c404ba1f8bd5a36fe75610447d696dbd
status: experimental
description: Detects generic indicators of the immirat malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*immirat*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the infected endpoint from the network; an active, human adversary is likely controlling the machine in real-time.
2. Assume all local credentials and session tokens on the machine have been compromised and initiate enterprise-wide password resets.
3. Capture a forensic memory image (RAM dump) to extract the decrypted C2 configuration and analyze any active reverse shell connections.
4. Hunt for lateral movement originating from the infected machine by analyzing Windows Event Logs (e.g., Event ID 4624 for successful network logons).

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not simply delete the RAT executable and leave the machine on the network; the attacker may have already established secondary backdoors or compromised other hosts.
2. Avoid relying solely on static AV scans, as RATs frequently update their payloads and inject into memory to evade file-based detection.

References & External Analysis

• Search "immirat" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Wecod
• Urausy
• Dalexis
• Genericrxdr
• Genasom

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/immirat.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.