Overview

overview

10

Static

static

10

b6427e1bb1...c1.exe

windows7_x64

10

b6427e1bb1...c1.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b6427e1bb10276b19f37bab1758cf2e867e4c4d7a87ae29aa54add1f0bf6fac1

  • Size

    3.5MB

  • Sample

    210518-99eh65c2yx

  • MD5

    067f9152f6d7e31d369d2da853ff219b

  • SHA1

    b37c48bca85dd90e4e73029c2c88ad3d6283c42e

  • SHA256

    b6427e1bb10276b19f37bab1758cf2e867e4c4d7a87ae29aa54add1f0bf6fac1

  • SHA512

    d0588850eaef0b54f042ee20334d4498d5c761b0c9139e83652134e8304a1c7a8947957d86d3288f1d22b7b1a08eb01cb3abd05cec32afb93de938bff255a2d3

Score
10/10
fakeavxmrigfakeavminerpersistencespyware

Malware Config

Targets

    • Target

      b6427e1bb10276b19f37bab1758cf2e867e4c4d7a87ae29aa54add1f0bf6fac1

    • Size

      3.5MB

    • MD5

      067f9152f6d7e31d369d2da853ff219b

    • SHA1

      b37c48bca85dd90e4e73029c2c88ad3d6283c42e

    • SHA256

      b6427e1bb10276b19f37bab1758cf2e867e4c4d7a87ae29aa54add1f0bf6fac1

    • SHA512

      d0588850eaef0b54f042ee20334d4498d5c761b0c9139e83652134e8304a1c7a8947957d86d3288f1d22b7b1a08eb01cb3abd05cec32afb93de938bff255a2d3

    Score
    10/10
    fakeavxmrigfakeavminerpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • FakeAV payload

      fakeavspyware

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks