Overview

overview

10

Static

static

10

1e989b90cb...c6.exe

windows7_x64

10

1e989b90cb...c6.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1e989b90cbfc5298ef3b0103f1c37bca9563bebb76070244b6fd45e433832dc6

  • Size

    812KB

  • Sample

    210509-tqanbkgr9e

  • MD5

    23407d38e2f1444c969e39b4aa5207bc

  • SHA1

    da68e1bf26879f4be03afb64f70639cb0fe5c132

  • SHA256

    1e989b90cbfc5298ef3b0103f1c37bca9563bebb76070244b6fd45e433832dc6

  • SHA512

    340dbffaa7765c0af628438bcbb3cda4abfe7a1eead81cfbeb3ac2471bae82d666123bec7944902c52c27385dc619db73427c3ba3ffe0765861454359a2b414f

Score
10/10
fakeavfakeavpersistencespyware

Malware Config

Targets

    • Target

      1e989b90cbfc5298ef3b0103f1c37bca9563bebb76070244b6fd45e433832dc6

    • Size

      812KB

    • MD5

      23407d38e2f1444c969e39b4aa5207bc

    • SHA1

      da68e1bf26879f4be03afb64f70639cb0fe5c132

    • SHA256

      1e989b90cbfc5298ef3b0103f1c37bca9563bebb76070244b6fd45e433832dc6

    • SHA512

      340dbffaa7765c0af628438bcbb3cda4abfe7a1eead81cfbeb3ac2471bae82d666123bec7944902c52c27385dc619db73427c3ba3ffe0765861454359a2b414f

    Score
    10/10
    fakeavfakeavpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks