Overview

overview

10

Static

static

10

69edb5a6e2...74.exe

windows7_x64

10

69edb5a6e2...74.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    69edb5a6e210764a2d44c08d54e820630c4da962b9b429883f7e6178a17fc774

  • Size

    864KB

  • Sample

    210517-3fnkml4bxn

  • MD5

    64b4c5588936a69039d37a9fac20a659

  • SHA1

    83148353ee9cf46f8d744dc2a3f2d23c4d6aa4a8

  • SHA256

    69edb5a6e210764a2d44c08d54e820630c4da962b9b429883f7e6178a17fc774

  • SHA512

    7b2ccbb68bc91b400abeb77908be7428456559dfe9f740026346abad44dae0a8b5959093663819712f524470ac9613edb3e33f2b9cbcbab0c05e37a761d9f5dd

Score
10/10
fakeavxmrigfakeavminerpersistencespyware

Malware Config

Targets

    • Target

      69edb5a6e210764a2d44c08d54e820630c4da962b9b429883f7e6178a17fc774

    • Size

      864KB

    • MD5

      64b4c5588936a69039d37a9fac20a659

    • SHA1

      83148353ee9cf46f8d744dc2a3f2d23c4d6aa4a8

    • SHA256

      69edb5a6e210764a2d44c08d54e820630c4da962b9b429883f7e6178a17fc774

    • SHA512

      7b2ccbb68bc91b400abeb77908be7428456559dfe9f740026346abad44dae0a8b5959093663819712f524470ac9613edb3e33f2b9cbcbab0c05e37a761d9f5dd

    Score
    10/10
    fakeavxmrigfakeavminerpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • FakeAV payload

      fakeavspyware

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks