Overview

overview

10

Static

static

10

539d58bdcc...fd.exe

windows7_x64

10

539d58bdcc...fd.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    539d58bdccf3215852b62826828d0bf23fef9590900a27693f1b5de40df05ffd

  • Size

    1.4MB

  • Sample

    210518-d7qyhdckj2

  • MD5

    de9003f8d6cc950e42bfe16ac985d0db

  • SHA1

    3e7ed096e1579e23067e4cf29f9248645d1477ab

  • SHA256

    539d58bdccf3215852b62826828d0bf23fef9590900a27693f1b5de40df05ffd

  • SHA512

    45f2184be3497d495229952507da04862256769add931e282472ce4ec3b5c0df876b1a369cbe0f92fd32d26ef732ef54913383aca8a8e9f529ce3f82559da7e6

Score
10/10
fakeavxmrigfakeavminerpersistencespyware

Malware Config

Targets

    • Target

      539d58bdccf3215852b62826828d0bf23fef9590900a27693f1b5de40df05ffd

    • Size

      1.4MB

    • MD5

      de9003f8d6cc950e42bfe16ac985d0db

    • SHA1

      3e7ed096e1579e23067e4cf29f9248645d1477ab

    • SHA256

      539d58bdccf3215852b62826828d0bf23fef9590900a27693f1b5de40df05ffd

    • SHA512

      45f2184be3497d495229952507da04862256769add931e282472ce4ec3b5c0df876b1a369cbe0f92fd32d26ef732ef54913383aca8a8e9f529ce3f82559da7e6

    Score
    10/10
    fakeavxmrigfakeavminerpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • FakeAV payload

      fakeavspyware

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks