Overview

overview

10

Static

static

10

8b897978b0...06.exe

windows7_x64

10

8b897978b0...06.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8b897978b0283f1a71e267e693a10fa47307c4f990b7bcbc6bb9256b7eeca106

  • Size

    1.6MB

  • Sample

    210509-b7wvgvmn6x

  • MD5

    f87a0b394b52735664b78d94d4a8a4de

  • SHA1

    a3cecd91554413da92c115f9824e5cd2c653be59

  • SHA256

    8b897978b0283f1a71e267e693a10fa47307c4f990b7bcbc6bb9256b7eeca106

  • SHA512

    32bda7e1d5013b89aaf58ed1cb2318d9e6996487a5fef466ab5ea71dde4013be044f71779adc49eb026883e8aff82213a92ec382604eb4abff2685abb96380b0

Score
10/10
fakeavfakeavpersistencespyware

Malware Config

Targets

    • Target

      8b897978b0283f1a71e267e693a10fa47307c4f990b7bcbc6bb9256b7eeca106

    • Size

      1.6MB

    • MD5

      f87a0b394b52735664b78d94d4a8a4de

    • SHA1

      a3cecd91554413da92c115f9824e5cd2c653be59

    • SHA256

      8b897978b0283f1a71e267e693a10fa47307c4f990b7bcbc6bb9256b7eeca106

    • SHA512

      32bda7e1d5013b89aaf58ed1cb2318d9e6996487a5fef466ab5ea71dde4013be044f71779adc49eb026883e8aff82213a92ec382604eb4abff2685abb96380b0

    Score
    10/10
    fakeavfakeavpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks