Overview

overview

10

Static

static

10

bb3599b7da...4b.exe

windows7_x64

10

bb3599b7da...4b.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bb3599b7da22a216386ede030d8c43aea042d1d68280b007fecc52914856434b

  • Size

    1.4MB

  • Sample

    210518-gn3lqkzflx

  • MD5

    8d23a25f997be98468dafdf55993a3b7

  • SHA1

    318195f222e8c6345812fd5bcb5020fb94d3027e

  • SHA256

    bb3599b7da22a216386ede030d8c43aea042d1d68280b007fecc52914856434b

  • SHA512

    9e3cb6ef6ef04a92e3301cc63365d4f6deed49a3c83f8cc3290d82088ad4b0e5f7272528affa85cd92f6e7928a5a56452959478b47875de7ea1df76f3913a546

Score
10/10
fakeavxmrigfakeavminerpersistencespyware

Malware Config

Targets

    • Target

      bb3599b7da22a216386ede030d8c43aea042d1d68280b007fecc52914856434b

    • Size

      1.4MB

    • MD5

      8d23a25f997be98468dafdf55993a3b7

    • SHA1

      318195f222e8c6345812fd5bcb5020fb94d3027e

    • SHA256

      bb3599b7da22a216386ede030d8c43aea042d1d68280b007fecc52914856434b

    • SHA512

      9e3cb6ef6ef04a92e3301cc63365d4f6deed49a3c83f8cc3290d82088ad4b0e5f7272528affa85cd92f6e7928a5a56452959478b47875de7ea1df76f3913a546

    Score
    10/10
    fakeavxmrigfakeavminerpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • FakeAV payload

      fakeavspyware

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks