Overview

overview

10

Static

static

10

c3643d162d...e3.exe

windows7_x64

10

c3643d162d...e3.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c3643d162d2c59801dc3fc12abaf9a463ccca81da7bbffd65737e156d86ba1e3

  • Size

    856KB

  • Sample

    210517-dvzynjxy1x

  • MD5

    67c004bbe561b9e73b38c62d0979f4b9

  • SHA1

    fef71f769262d2831972f211198e68bdfc49bf50

  • SHA256

    c3643d162d2c59801dc3fc12abaf9a463ccca81da7bbffd65737e156d86ba1e3

  • SHA512

    833b6a046475b60b944e57306e2e1827319a17fb0827504f6b3d618d944092964638caf278d105d101adaa065450a76b1cf184250e8559b20dbbc656465b1f18

Score
10/10
fakeavxmrigfakeavminerpersistencespyware

Malware Config

Targets

    • Target

      c3643d162d2c59801dc3fc12abaf9a463ccca81da7bbffd65737e156d86ba1e3

    • Size

      856KB

    • MD5

      67c004bbe561b9e73b38c62d0979f4b9

    • SHA1

      fef71f769262d2831972f211198e68bdfc49bf50

    • SHA256

      c3643d162d2c59801dc3fc12abaf9a463ccca81da7bbffd65737e156d86ba1e3

    • SHA512

      833b6a046475b60b944e57306e2e1827319a17fb0827504f6b3d618d944092964638caf278d105d101adaa065450a76b1cf184250e8559b20dbbc656465b1f18

    Score
    10/10
    fakeavxmrigfakeavminerpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • FakeAV payload

      fakeavspyware

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks