fakeav | 424d0b2802a71865ebacd2b5cfce5a995d766fa9e343e03d9251b96c5e520126 | Triage

Submit
Reports

Overview

overview

Static

static

424d0b2802...26.exe

windows7-x64

424d0b2802...26.exe

windows10-2004-x64

Sharing

General

Target

424d0b2802a71865ebacd2b5cfce5a995d766fa9e343e03d9251b96c5e520126
Size

755KB
Sample

221119-jplfjaba77
MD5

15569b463338ec56487dc035b7bfd8e5
SHA1

7052aedb663f781e38ad420f593613140c04e8f9
SHA256

424d0b2802a71865ebacd2b5cfce5a995d766fa9e343e03d9251b96c5e520126
SHA512

5bbd9172210c6eaa0b88f01037c624e2fa6c959c549260070019c91d765da7ad86c3467c638fdb11e83a9e992c4c8b4bfefcd27436078894cadbc363de491ef3
SSDEEP

12288:xoxejOONAM7GUC1Jr+4o628gx2Jw+tP3Jzm8JOPGXCJdw/oX+pd167QhEQO:2xY3NtGUmJr+4Obxd+tPZSZu/oE6EhE

Score

10^/10

fakeav fakeav persistence spyware upx

Static task

static1

fakeav spyware fakeav

2 signatures

Behavioral task

behavioral1

Sample

424d0b2802a71865ebacd2b5cfce5a995d766fa9e343e03d9251b96c5e520126.exe

Resource

win7-20221111-en

fakeav fakeav persistence spyware upx

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

424d0b2802a71865ebacd2b5cfce5a995d766fa9e343e03d9251b96c5e520126.exe

Resource

win10v2004-20220812-en

fakeav fakeav persistence spyware upx

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  424d0b2802a71865ebacd2b5cfce5a995d766fa9e343e03d9251b96c5e520126
- Size
  
  755KB
- MD5
  
  15569b463338ec56487dc035b7bfd8e5
- SHA1
  
  7052aedb663f781e38ad420f593613140c04e8f9
- SHA256
  
  424d0b2802a71865ebacd2b5cfce5a995d766fa9e343e03d9251b96c5e520126
- SHA512
  
  5bbd9172210c6eaa0b88f01037c624e2fa6c959c549260070019c91d765da7ad86c3467c638fdb11e83a9e992c4c8b4bfefcd27436078894cadbc363de491ef3
- SSDEEP
  
  12288:xoxejOONAM7GUC1Jr+4o628gx2Jw+tP3Jzm8JOPGXCJdw/oX+pd167QhEQO:2xY3NtGUmJr+4Obxd+tPZSZu/oE6EhE
Score

10^/10

fakeav fakeav persistence spyware upx
- FakeAV, RogueAntivirus
  FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
  fakeav spyware fakeav
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

fakeavspywarefakeav

behavioral1

fakeavfakeavpersistencespywareupx

behavioral2

fakeavfakeavpersistencespywareupx

© 2018-2025

Terms | Privacy