Overview

overview

10

Static

static

10

666c69392b...58.exe

windows7_x64

10

666c69392b...58.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    666c69392bfc924f0401d065d3adff474baf2360514226d781f4eabdb3bc3b58

  • Size

    724KB

  • Sample

    210518-cr3nmpe3ax

  • MD5

    bfe1cac19d864de60a1c1a34533c17b1

  • SHA1

    0e6473f30546d84a48c2710aff23608601cca30e

  • SHA256

    666c69392bfc924f0401d065d3adff474baf2360514226d781f4eabdb3bc3b58

  • SHA512

    b761578eeed7ddf5fa2846ce47e7e068f7efe46c19ed3084a8261ef6a637632cc3b1d9927758c6fa00a62ad0a8a7c0f641c6a9ed5b829fce8f58b3ca039f5737

Score
10/10
fakeavxmrigfakeavminerpersistencespyware

Malware Config

Targets

    • Target

      666c69392bfc924f0401d065d3adff474baf2360514226d781f4eabdb3bc3b58

    • Size

      724KB

    • MD5

      bfe1cac19d864de60a1c1a34533c17b1

    • SHA1

      0e6473f30546d84a48c2710aff23608601cca30e

    • SHA256

      666c69392bfc924f0401d065d3adff474baf2360514226d781f4eabdb3bc3b58

    • SHA512

      b761578eeed7ddf5fa2846ce47e7e068f7efe46c19ed3084a8261ef6a637632cc3b1d9927758c6fa00a62ad0a8a7c0f641c6a9ed5b829fce8f58b3ca039f5737

    Score
    10/10
    fakeavxmrigfakeavminerpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • FakeAV payload

      fakeavspyware

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks