Overview

overview

10

Static

static

10

2bf04ce35b...39.exe

windows7_x64

10

2bf04ce35b...39.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2bf04ce35bac2c2321b71d8ab392195133ce2cf942d9c9c4f597e7b299a23639

  • Size

    724KB

  • Sample

    220309-byardscab4

  • MD5

    0157ca9826104cfe332625475c99ceea

  • SHA1

    d772f88a920d21dd01a89d7fbabda1ae3157a02a

  • SHA256

    2bf04ce35bac2c2321b71d8ab392195133ce2cf942d9c9c4f597e7b299a23639

  • SHA512

    d26e8e72d073bce10fa4eaf9ea27535550ea3ae8e157570d2a749af8824c7fa0092819979b1f8c19fdd472af94d50a0c7e686ae99da28a8132359b9313885daa

Score
10/10
fakeavfakeavpersistencespyware

Malware Config

Targets

    • Target

      2bf04ce35bac2c2321b71d8ab392195133ce2cf942d9c9c4f597e7b299a23639

    • Size

      724KB

    • MD5

      0157ca9826104cfe332625475c99ceea

    • SHA1

      d772f88a920d21dd01a89d7fbabda1ae3157a02a

    • SHA256

      2bf04ce35bac2c2321b71d8ab392195133ce2cf942d9c9c4f597e7b299a23639

    • SHA512

      d26e8e72d073bce10fa4eaf9ea27535550ea3ae8e157570d2a749af8824c7fa0092819979b1f8c19fdd472af94d50a0c7e686ae99da28a8132359b9313885daa

    Score
    10/10
    fakeavfakeavpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • FakeAV payload

      fakeavspyware

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks