fakeav | 6f391d0bef76a8f7474071dca5c1b04c869c1ced53f1f9ecf8bb5e5f1d86cc51 | Triage

Submit
Reports

Overview

overview

Static

static

6f391d0bef...51.exe

windows7-x64

6f391d0bef...51.exe

windows10-2004-x64

Sharing

General

Target

6f391d0bef76a8f7474071dca5c1b04c869c1ced53f1f9ecf8bb5e5f1d86cc51
Size

755KB
Sample

221201-jly78aca6w
MD5

87b6c78a8c50ed939a060244184c0c85
SHA1

cf6b4f8e6c1171592a1f532de622d6f821b628b5
SHA256

6f391d0bef76a8f7474071dca5c1b04c869c1ced53f1f9ecf8bb5e5f1d86cc51
SHA512

6329bd6879e273044c9165c8441e4d3f20a9fb8a5f1978e79e1934e35e54c1bbe474e247e45f65ba675f6331d8608b528aad221ab60a1821e8029b13192ee238
SSDEEP

12288:xoxejOONAM7GUC1Jr+4o628gx2Jw+tP3Jzm8JOmGXCJdw/oX+pd167QhEQO:2xY3NtGUmJr+4Obxd+tPZSZX/oE6EhE

Score

10^/10

fakeav fakeav persistence spyware upx

Static task

static1

fakeav spyware fakeav

2 signatures

Behavioral task

behavioral1

Sample

6f391d0bef76a8f7474071dca5c1b04c869c1ced53f1f9ecf8bb5e5f1d86cc51.exe

Resource

win7-20220812-en

fakeav fakeav persistence spyware upx

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

6f391d0bef76a8f7474071dca5c1b04c869c1ced53f1f9ecf8bb5e5f1d86cc51.exe

Resource

win10v2004-20220901-en

fakeav fakeav persistence spyware upx

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  6f391d0bef76a8f7474071dca5c1b04c869c1ced53f1f9ecf8bb5e5f1d86cc51
- Size
  
  755KB
- MD5
  
  87b6c78a8c50ed939a060244184c0c85
- SHA1
  
  cf6b4f8e6c1171592a1f532de622d6f821b628b5
- SHA256
  
  6f391d0bef76a8f7474071dca5c1b04c869c1ced53f1f9ecf8bb5e5f1d86cc51
- SHA512
  
  6329bd6879e273044c9165c8441e4d3f20a9fb8a5f1978e79e1934e35e54c1bbe474e247e45f65ba675f6331d8608b528aad221ab60a1821e8029b13192ee238
- SSDEEP
  
  12288:xoxejOONAM7GUC1Jr+4o628gx2Jw+tP3Jzm8JOmGXCJdw/oX+pd167QhEQO:2xY3NtGUmJr+4Obxd+tPZSZX/oE6EhE
Score

10^/10

fakeav fakeav persistence spyware upx
- FakeAV, RogueAntivirus
  FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
  fakeav spyware fakeav
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

fakeavspywarefakeav

behavioral1

fakeavfakeavpersistencespywareupx

behavioral2

fakeavfakeavpersistencespywareupx

© 2018-2025

Terms | Privacy