Overview

overview

10

Static

static

10

faf4629c65...f3.exe

windows7_x64

10

faf4629c65...f3.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    faf4629c657dbe64969baa5cfd2bdeca25b2bb6cc9b622a52acec10367f784f3

  • Size

    711KB

  • Sample

    220707-zalqrachf6

  • MD5

    4423e76bd99a99d1149aabe609ed966d

  • SHA1

    3a983e82607ac3cfa39725a582307b72a64c6b66

  • SHA256

    faf4629c657dbe64969baa5cfd2bdeca25b2bb6cc9b622a52acec10367f784f3

  • SHA512

    b1a05e51cfe21d58765a6f1782bc9da2602ce2b4b768d23018e6b61e7b0c01ebfa71327ec5cb14ac61a2de86d6133cdc87397917142f7eadb71280a5951c0b58

Score
10/10
fakeavfakeavpersistencespyware

Malware Config

Targets

    • Target

      faf4629c657dbe64969baa5cfd2bdeca25b2bb6cc9b622a52acec10367f784f3

    • Size

      711KB

    • MD5

      4423e76bd99a99d1149aabe609ed966d

    • SHA1

      3a983e82607ac3cfa39725a582307b72a64c6b66

    • SHA256

      faf4629c657dbe64969baa5cfd2bdeca25b2bb6cc9b622a52acec10367f784f3

    • SHA512

      b1a05e51cfe21d58765a6f1782bc9da2602ce2b4b768d23018e6b61e7b0c01ebfa71327ec5cb14ac61a2de86d6133cdc87397917142f7eadb71280a5951c0b58

    Score
    10/10
    fakeavfakeavpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks