Overview

overview

10

Static

static

10

530bd71d29...98.exe

windows7_x64

10

530bd71d29...98.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    530bd71d2938d6ce76b184091d3553502eb59c12b954c453d3e4e3f7b4eea698

  • Size

    711KB

  • Sample

    220511-de86ysebb8

  • MD5

    04c0e38dc52294e87405cd6876c407ce

  • SHA1

    eea009875649d8b3b66a8e5049f4b8810aefa86f

  • SHA256

    530bd71d2938d6ce76b184091d3553502eb59c12b954c453d3e4e3f7b4eea698

  • SHA512

    79754bf9c7415e5a2305cf27229020be48b5e74233c7235aae1924354d8fa81dec4de4f4ca0930fe75723a3a652b9388558397f5d26edd306578aad69275a624

Score
10/10
fakeavfakeavpersistencespyware

Malware Config

Targets

    • Target

      530bd71d2938d6ce76b184091d3553502eb59c12b954c453d3e4e3f7b4eea698

    • Size

      711KB

    • MD5

      04c0e38dc52294e87405cd6876c407ce

    • SHA1

      eea009875649d8b3b66a8e5049f4b8810aefa86f

    • SHA256

      530bd71d2938d6ce76b184091d3553502eb59c12b954c453d3e4e3f7b4eea698

    • SHA512

      79754bf9c7415e5a2305cf27229020be48b5e74233c7235aae1924354d8fa81dec4de4f4ca0930fe75723a3a652b9388558397f5d26edd306578aad69275a624

    Score
    10/10
    fakeavfakeavpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks