Overview

overview

10

Static

static

10

c672a515cb...b1.exe

windows7_x64

10

c672a515cb...b1.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c672a515cb9572cfc7c8492637de5875b93d1c3776a77a3c18df4822ab6301b1

  • Size

    6.4MB

  • Sample

    210517-4k53g63tgj

  • MD5

    1ca071ab8158bf41d0e63d1f362638fc

  • SHA1

    203a2844233204b204b1f5aed0ad62712e02fe06

  • SHA256

    c672a515cb9572cfc7c8492637de5875b93d1c3776a77a3c18df4822ab6301b1

  • SHA512

    3313644ca0bc7543fb1750231b42b236023a0f98ae111547a49c799a25fbe9ed0b1619d226a2781deaf62bdbce5126dec6a72626858b022d5f65c950b3ce1801

Score
10/10
fakeavxmrigfakeavminerpersistencespyware

Malware Config

Targets

    • Target

      c672a515cb9572cfc7c8492637de5875b93d1c3776a77a3c18df4822ab6301b1

    • Size

      6.4MB

    • MD5

      1ca071ab8158bf41d0e63d1f362638fc

    • SHA1

      203a2844233204b204b1f5aed0ad62712e02fe06

    • SHA256

      c672a515cb9572cfc7c8492637de5875b93d1c3776a77a3c18df4822ab6301b1

    • SHA512

      3313644ca0bc7543fb1750231b42b236023a0f98ae111547a49c799a25fbe9ed0b1619d226a2781deaf62bdbce5126dec6a72626858b022d5f65c950b3ce1801

    Score
    10/10
    fakeavxmrigfakeavminerpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • FakeAV payload

      fakeavspyware

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks