Overview

overview

10

Static

static

10

08d982b82f...f4.exe

windows7_x64

10

08d982b82f...f4.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08d982b82f2477ac204c036624c4f6186f6b8eb4088a2b8999b2a6d6d14a82f4

  • Size

    1.4MB

  • Sample

    210518-q64wgzlml6

  • MD5

    68b01b558d2559445b5f4f5236944c0a

  • SHA1

    b86557edcd41a569e4a759c930ff49187aba679b

  • SHA256

    08d982b82f2477ac204c036624c4f6186f6b8eb4088a2b8999b2a6d6d14a82f4

  • SHA512

    d6fcd2d07b55d16b5d545dc666d1d5d6b7a1ffdb16ece3e821724175f36059d521b20bcac819f10ea997c6bc4471117a5a000d478dfdb8a188208b17f7954c52

Score
10/10
fakeavxmrigfakeavminerpersistencespyware

Malware Config

Targets

    • Target

      08d982b82f2477ac204c036624c4f6186f6b8eb4088a2b8999b2a6d6d14a82f4

    • Size

      1.4MB

    • MD5

      68b01b558d2559445b5f4f5236944c0a

    • SHA1

      b86557edcd41a569e4a759c930ff49187aba679b

    • SHA256

      08d982b82f2477ac204c036624c4f6186f6b8eb4088a2b8999b2a6d6d14a82f4

    • SHA512

      d6fcd2d07b55d16b5d545dc666d1d5d6b7a1ffdb16ece3e821724175f36059d521b20bcac819f10ea997c6bc4471117a5a000d478dfdb8a188208b17f7954c52

    Score
    10/10
    fakeavxmrigfakeavminerpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • FakeAV payload

      fakeavspyware

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks