Overview

overview

10

Static

static

10

ca0fe9fdf1...9a.exe

windows7_x64

10

ca0fe9fdf1...9a.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ca0fe9fdf17e57cb1ef928541306af9a

  • Size

    812KB

  • Sample

    201214-m6cfzlntnx

  • MD5

    ca0fe9fdf17e57cb1ef928541306af9a

  • SHA1

    d4b1c06c4726be24dd2c1d5a709a88c552459c51

  • SHA256

    541da4c942bdad70c87fc063967d7cfac77f99c7b2b2b0b271bf31a9558dd8de

  • SHA512

    9fff777624aa140ae06ce965ce1fb51aa6b529a73fc0e493c08f6e96f830f533406460fce6fb8fbdb774e8fab0a46bbeab9d546fdaad49e5a3b4b5149c5c5bb1

Score
10/10
fakeavfakeavpersistencespyware

Malware Config

Targets

    • Target

      ca0fe9fdf17e57cb1ef928541306af9a

    • Size

      812KB

    • MD5

      ca0fe9fdf17e57cb1ef928541306af9a

    • SHA1

      d4b1c06c4726be24dd2c1d5a709a88c552459c51

    • SHA256

      541da4c942bdad70c87fc063967d7cfac77f99c7b2b2b0b271bf31a9558dd8de

    • SHA512

      9fff777624aa140ae06ce965ce1fb51aa6b529a73fc0e493c08f6e96f830f533406460fce6fb8fbdb774e8fab0a46bbeab9d546fdaad49e5a3b4b5149c5c5bb1

    Score
    10/10
    fakeavfakeavpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks