Overview

overview

10

Static

static

10

41fe5deac9...6c.exe

windows7_x64

10

41fe5deac9...6c.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    41fe5deac9eb948cc6ef9cbcbaac644ee89245c43f14aee37024560846d2776c

  • Size

    9.9MB

  • Sample

    210517-qy1sxmxlca

  • MD5

    c6fd60365aa5372c646cb9d3006d332a

  • SHA1

    582797d33d3350e8ef6bc2bd4ed3e4337c308072

  • SHA256

    41fe5deac9eb948cc6ef9cbcbaac644ee89245c43f14aee37024560846d2776c

  • SHA512

    04e5a8d96cb6f2c3efaa3f3f1892a128e6ce6727af663b76df132b190f46ebc2979e26080a086a944a654deed9a96279a9c7f49aa27e82faf7228e4290a24b2d

Score
10/10
fakeavxmrigfakeavminerpersistencespyware

Malware Config

Targets

    • Target

      41fe5deac9eb948cc6ef9cbcbaac644ee89245c43f14aee37024560846d2776c

    • Size

      9.9MB

    • MD5

      c6fd60365aa5372c646cb9d3006d332a

    • SHA1

      582797d33d3350e8ef6bc2bd4ed3e4337c308072

    • SHA256

      41fe5deac9eb948cc6ef9cbcbaac644ee89245c43f14aee37024560846d2776c

    • SHA512

      04e5a8d96cb6f2c3efaa3f3f1892a128e6ce6727af663b76df132b190f46ebc2979e26080a086a944a654deed9a96279a9c7f49aa27e82faf7228e4290a24b2d

    Score
    10/10
    fakeavxmrigfakeavminerpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • FakeAV payload

      fakeavspyware

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks