Overview

overview

10

Static

static

10

35ee5539c3...17.exe

windows7_x64

10

35ee5539c3...17.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    35ee5539c306158be3db425cc339f2a6c572525434eb4363d7107b655d548917

  • Size

    928KB

  • Sample

    210517-mf22jr8nzn

  • MD5

    6806ab41783cf3af980878e432ce5440

  • SHA1

    b4d079f21a59811b35013143e57746462ee073a1

  • SHA256

    35ee5539c306158be3db425cc339f2a6c572525434eb4363d7107b655d548917

  • SHA512

    e19ed4b83883b71cb1378164aa085080b94b53d05f8ece0733565f5fa8952871638fd4133173c505d0e6a6ab92e0679dff636486e17d0d8b7b5739bfc4f4d1a8

Score
10/10
fakeavxmrigfakeavminerpersistencespyware

Malware Config

Targets

    • Target

      35ee5539c306158be3db425cc339f2a6c572525434eb4363d7107b655d548917

    • Size

      928KB

    • MD5

      6806ab41783cf3af980878e432ce5440

    • SHA1

      b4d079f21a59811b35013143e57746462ee073a1

    • SHA256

      35ee5539c306158be3db425cc339f2a6c572525434eb4363d7107b655d548917

    • SHA512

      e19ed4b83883b71cb1378164aa085080b94b53d05f8ece0733565f5fa8952871638fd4133173c505d0e6a6ab92e0679dff636486e17d0d8b7b5739bfc4f4d1a8

    Score
    10/10
    fakeavxmrigfakeavminerpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • FakeAV payload

      fakeavspyware

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks