Overview

overview

10

Static

static

10

5da36b0d9e...43.exe

windows7_x64

10

5da36b0d9e...43.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5da36b0d9e9c193a1ff7d1480d78e4e948ba0ec4c52a87d9c95966c5779e0643

  • Size

    724KB

  • Sample

    210513-pzf7phr4vs

  • MD5

    6b8df6ed598c7b0e26d1d1e005226240

  • SHA1

    c0bc28643bc8b11102e03993607da40366ce1257

  • SHA256

    5da36b0d9e9c193a1ff7d1480d78e4e948ba0ec4c52a87d9c95966c5779e0643

  • SHA512

    1a2f84a1260039d6846992221563729877186de078dbe59efcd12772dc77f95890db9860c276cf191db14a06cdbb90a87204f304f0d0b44611802fec3ba6633a

Score
10/10
fakeavxmrigfakeavminerpersistencespyware

Malware Config

Targets

    • Target

      5da36b0d9e9c193a1ff7d1480d78e4e948ba0ec4c52a87d9c95966c5779e0643

    • Size

      724KB

    • MD5

      6b8df6ed598c7b0e26d1d1e005226240

    • SHA1

      c0bc28643bc8b11102e03993607da40366ce1257

    • SHA256

      5da36b0d9e9c193a1ff7d1480d78e4e948ba0ec4c52a87d9c95966c5779e0643

    • SHA512

      1a2f84a1260039d6846992221563729877186de078dbe59efcd12772dc77f95890db9860c276cf191db14a06cdbb90a87204f304f0d0b44611802fec3ba6633a

    Score
    10/10
    fakeavxmrigfakeavminerpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • FakeAV payload

      fakeavspyware

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks