Overview

overview

10

Static

static

10

0200ca0104...a0.exe

windows7_x64

10

0200ca0104...a0.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0200ca01043a48f818954c4e5868e0ab74a0eadda182a59f4bebc689aa0e46a0

  • Size

    812KB

  • Sample

    210509-fjygr2yblj

  • MD5

    d3221ce75ebfbfd9740d641de35b4602

  • SHA1

    3fe23fb8217c0a43436cfe99ed3756f14856f122

  • SHA256

    0200ca01043a48f818954c4e5868e0ab74a0eadda182a59f4bebc689aa0e46a0

  • SHA512

    b436d657392b9d3e0d43779094c6e7b809f9032f38b09b0d14aed9690a943e0fa1df9e52be81e5a4f139a356ba6ab09388cc6836127e6b14fc484893823a4ed2

Score
10/10
fakeavfakeavpersistencespyware

Malware Config

Targets

    • Target

      0200ca01043a48f818954c4e5868e0ab74a0eadda182a59f4bebc689aa0e46a0

    • Size

      812KB

    • MD5

      d3221ce75ebfbfd9740d641de35b4602

    • SHA1

      3fe23fb8217c0a43436cfe99ed3756f14856f122

    • SHA256

      0200ca01043a48f818954c4e5868e0ab74a0eadda182a59f4bebc689aa0e46a0

    • SHA512

      b436d657392b9d3e0d43779094c6e7b809f9032f38b09b0d14aed9690a943e0fa1df9e52be81e5a4f139a356ba6ab09388cc6836127e6b14fc484893823a4ed2

    Score
    10/10
    fakeavfakeavpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks