Overview

overview

10

Static

static

10

ee8ac390ff...ce.exe

windows7_x64

10

ee8ac390ff...ce.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ee8ac390ffbf27a45ccbf1196a0824aee4bf92a02ae95037bc18cc83469c90ce

  • Size

    812KB

  • Sample

    210508-55xqxa4jza

  • MD5

    cb48431d0d9689f2493161c9ebc18216

  • SHA1

    898f95dfff33b7dcd8e4dda2940f733b2e00c4f8

  • SHA256

    ee8ac390ffbf27a45ccbf1196a0824aee4bf92a02ae95037bc18cc83469c90ce

  • SHA512

    423396a135d6df961919418ce6e98b37db54e7f0f5cd5815e0a7e91245255429a444a976b34d08e68552035c9d1d5b41bbba3d72cc96c5451c2a4a515f315879

Score
10/10
fakeavfakeavpersistencespyware

Malware Config

Targets

    • Target

      ee8ac390ffbf27a45ccbf1196a0824aee4bf92a02ae95037bc18cc83469c90ce

    • Size

      812KB

    • MD5

      cb48431d0d9689f2493161c9ebc18216

    • SHA1

      898f95dfff33b7dcd8e4dda2940f733b2e00c4f8

    • SHA256

      ee8ac390ffbf27a45ccbf1196a0824aee4bf92a02ae95037bc18cc83469c90ce

    • SHA512

      423396a135d6df961919418ce6e98b37db54e7f0f5cd5815e0a7e91245255429a444a976b34d08e68552035c9d1d5b41bbba3d72cc96c5451c2a4a515f315879

    Score
    10/10
    fakeavfakeavpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks