Overview

overview

10

Static

static

10

f9bfb620db...f5.exe

windows7_x64

10

f9bfb620db...f5.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f9bfb620db6ee494df0bdb5b49c4ba29db3cc04ebfaff2c8bfd611a21b34e3f5

  • Size

    1.4MB

  • Sample

    210517-khbcyak4xj

  • MD5

    9a8b3cee341648265d30a65402015a63

  • SHA1

    0b6dc283d6b38f45d22567f3a61d34edff5f5ad2

  • SHA256

    f9bfb620db6ee494df0bdb5b49c4ba29db3cc04ebfaff2c8bfd611a21b34e3f5

  • SHA512

    a10cff02d6153dbf37aaf767826a8024620fac097c0164cf0d70cc880f03435c492976708f53a7c7950508fcab92fa2ec3971621555aaaf039fe2138bca45984

Score
10/10
fakeavxmrigfakeavminerpersistencespyware

Malware Config

Targets

    • Target

      f9bfb620db6ee494df0bdb5b49c4ba29db3cc04ebfaff2c8bfd611a21b34e3f5

    • Size

      1.4MB

    • MD5

      9a8b3cee341648265d30a65402015a63

    • SHA1

      0b6dc283d6b38f45d22567f3a61d34edff5f5ad2

    • SHA256

      f9bfb620db6ee494df0bdb5b49c4ba29db3cc04ebfaff2c8bfd611a21b34e3f5

    • SHA512

      a10cff02d6153dbf37aaf767826a8024620fac097c0164cf0d70cc880f03435c492976708f53a7c7950508fcab92fa2ec3971621555aaaf039fe2138bca45984

    Score
    10/10
    fakeavxmrigfakeavminerpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • FakeAV payload

      fakeavspyware

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks