Overview

overview

10

Static

static

10

90f8419858...f5.exe

windows7_x64

10

90f8419858...f5.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    90f8419858400218ec4938ebe7f2a3065a1cde6da4536daf3d0942c6808597f5

  • Size

    1.6MB

  • Sample

    210511-4f13nswzhj

  • MD5

    fba8bf88bcda6ff0768c07f3ef726dd0

  • SHA1

    2da671735132dbd19fd67fa9a80bdb950af7a29e

  • SHA256

    90f8419858400218ec4938ebe7f2a3065a1cde6da4536daf3d0942c6808597f5

  • SHA512

    b61af6c62bd6c3d36cf362e5a25b4e025bbedb9c4bc910027d8ff7598e6502f6de90bab72618a2bc8f8cada19d3cd376491a8a599ec8c73675bcef1829c6daaa

Score
10/10
fakeavfakeavpersistencespyware

Malware Config

Targets

    • Target

      90f8419858400218ec4938ebe7f2a3065a1cde6da4536daf3d0942c6808597f5

    • Size

      1.6MB

    • MD5

      fba8bf88bcda6ff0768c07f3ef726dd0

    • SHA1

      2da671735132dbd19fd67fa9a80bdb950af7a29e

    • SHA256

      90f8419858400218ec4938ebe7f2a3065a1cde6da4536daf3d0942c6808597f5

    • SHA512

      b61af6c62bd6c3d36cf362e5a25b4e025bbedb9c4bc910027d8ff7598e6502f6de90bab72618a2bc8f8cada19d3cd376491a8a599ec8c73675bcef1829c6daaa

    Score
    10/10
    fakeavfakeavpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks