Overview

overview

10

Static

static

10

31dee19fd1...f5.exe

windows7-x64

10

31dee19fd1...f5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    31dee19fd1d6981c527593ec4c3f40fc8c6ca46ad5e939b91c65ad5c982a3cf5

  • Size

    724KB

  • Sample

    221108-nlvl9afgdr

  • MD5

    02f911c03a2c866cdee79bab25db84c1

  • SHA1

    5319aff31d50b88fe4f03816522f4ee05258f5f1

  • SHA256

    31dee19fd1d6981c527593ec4c3f40fc8c6ca46ad5e939b91c65ad5c982a3cf5

  • SHA512

    6a429ca30b2800fed37b1de847a6f08229bde196f7e9423ae53aa3b4811e266d95aaea5333a120257f4b38d83ecb3b09389696b21e92f9d06aa018d13d74c133

  • SSDEEP

    12288:lB6jfu9W5qVnpA1P9mTx87m7HGA04OBGaSuQalOZeW0dzNfX+pd167QhEQJ:n67MnVnpA1lmTx8MmA07AaSuDSwdtE6o

Score
10/10
fakeavfakeavpersistencespyware

Malware Config

Targets

    • Target

      31dee19fd1d6981c527593ec4c3f40fc8c6ca46ad5e939b91c65ad5c982a3cf5

    • Size

      724KB

    • MD5

      02f911c03a2c866cdee79bab25db84c1

    • SHA1

      5319aff31d50b88fe4f03816522f4ee05258f5f1

    • SHA256

      31dee19fd1d6981c527593ec4c3f40fc8c6ca46ad5e939b91c65ad5c982a3cf5

    • SHA512

      6a429ca30b2800fed37b1de847a6f08229bde196f7e9423ae53aa3b4811e266d95aaea5333a120257f4b38d83ecb3b09389696b21e92f9d06aa018d13d74c133

    • SSDEEP

      12288:lB6jfu9W5qVnpA1P9mTx87m7HGA04OBGaSuQalOZeW0dzNfX+pd167QhEQJ:n67MnVnpA1lmTx8MmA07AaSuDSwdtE6o

    Score
    10/10
    fakeavfakeavpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • FakeAV payload

      fakeavspyware

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks