Overview

overview

10

Static

static

10

830da56ed9...a9.exe

windows7_x64

10

830da56ed9...a9.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    830da56ed9ef17adb5aebe549fece13187d51ee9f27563e6bc331eb637e725a9

  • Size

    1.6MB

  • Sample

    210509-eerbqemw66

  • MD5

    b939fdbef169ab1158957d829a68fc69

  • SHA1

    e64f3fd48dd773322a7255ef3b2731d5f58c8a66

  • SHA256

    830da56ed9ef17adb5aebe549fece13187d51ee9f27563e6bc331eb637e725a9

  • SHA512

    fc3b7758a320275aca0ca5ec0a610034c5142e870dbfa83b7e66906bb62f8762b66b55151d4a616b1100ff79123c034d293506a965d82ec0a82ba40491e7b402

Score
10/10
fakeavfakeavpersistencespyware

Malware Config

Targets

    • Target

      830da56ed9ef17adb5aebe549fece13187d51ee9f27563e6bc331eb637e725a9

    • Size

      1.6MB

    • MD5

      b939fdbef169ab1158957d829a68fc69

    • SHA1

      e64f3fd48dd773322a7255ef3b2731d5f58c8a66

    • SHA256

      830da56ed9ef17adb5aebe549fece13187d51ee9f27563e6bc331eb637e725a9

    • SHA512

      fc3b7758a320275aca0ca5ec0a610034c5142e870dbfa83b7e66906bb62f8762b66b55151d4a616b1100ff79123c034d293506a965d82ec0a82ba40491e7b402

    Score
    10/10
    fakeavfakeavpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks