Overview

overview

10

Static

static

10

3882e701b1...0f.exe

windows7_x64

10

3882e701b1...0f.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3882e701b140e684a9968a08daf6c4f9dd2984ab4b1c43b1682affbaa6df5e0f

  • Size

    724KB

  • Sample

    210515-b8fvkb8g7n

  • MD5

    ce78653a098e5a20b071e20db43d9981

  • SHA1

    673da915903093a9cb0619d0d2c0838d5d69d1a4

  • SHA256

    3882e701b140e684a9968a08daf6c4f9dd2984ab4b1c43b1682affbaa6df5e0f

  • SHA512

    bf57b79a24135984105b6a018a5de090955d1df900040f1dc9dddfee7e23e386bb18226e26e33521ba8c4dd34a0518da3d21b890c0d02167af777d605b889fb8

Score
10/10
fakeavxmrigfakeavminerpersistencespyware

Malware Config

Targets

    • Target

      3882e701b140e684a9968a08daf6c4f9dd2984ab4b1c43b1682affbaa6df5e0f

    • Size

      724KB

    • MD5

      ce78653a098e5a20b071e20db43d9981

    • SHA1

      673da915903093a9cb0619d0d2c0838d5d69d1a4

    • SHA256

      3882e701b140e684a9968a08daf6c4f9dd2984ab4b1c43b1682affbaa6df5e0f

    • SHA512

      bf57b79a24135984105b6a018a5de090955d1df900040f1dc9dddfee7e23e386bb18226e26e33521ba8c4dd34a0518da3d21b890c0d02167af777d605b889fb8

    Score
    10/10
    fakeavfakeavpersistencespywarexmrigminer

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • FakeAV payload

      fakeavspyware

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks