fakeav | 84f1733a3efb8dd690c7c7437b967f16a0688d3b4b074e7851a056cdebf6333b | Triage

Submit
Reports

Overview

overview

Static

static

84f1733a3e...3b.exe

windows7-x64

84f1733a3e...3b.exe

windows10-2004-x64

Sharing

General

Target

84f1733a3efb8dd690c7c7437b967f16a0688d3b4b074e7851a056cdebf6333b
Size

755KB
Sample

221201-jlyaxsge95
MD5

b7f7fa92fa13abdd8923703d457f7904
SHA1

536b7e85ed8eda9a12e00371fb17df631cb17b3a
SHA256

84f1733a3efb8dd690c7c7437b967f16a0688d3b4b074e7851a056cdebf6333b
SHA512

a6e19daf443677e5e65b91cf4f5efec59dfb6ee4345c6fd485f8cdea1eac1ea638c60c310d5b21934659e6d202ca2a8ada409c4576d9d789a239129655c14cb1
SSDEEP

12288:xoxejOONAM7GUC1Jr+4o628gx2Jw+tP3Jzm8JOtGXCJdw/oX+pd167QhEQO:2xY3NtGUmJr+4Obxd+tPZSZ0/oE6EhE

Score

10^/10

fakeav fakeav persistence spyware upx

Static task

static1

fakeav spyware fakeav

2 signatures

Behavioral task

behavioral1

Sample

84f1733a3efb8dd690c7c7437b967f16a0688d3b4b074e7851a056cdebf6333b.exe

Resource

win7-20220901-en

fakeav fakeav persistence spyware upx

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

84f1733a3efb8dd690c7c7437b967f16a0688d3b4b074e7851a056cdebf6333b.exe

Resource

win10v2004-20220812-en

fakeav fakeav persistence spyware upx

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  84f1733a3efb8dd690c7c7437b967f16a0688d3b4b074e7851a056cdebf6333b
- Size
  
  755KB
- MD5
  
  b7f7fa92fa13abdd8923703d457f7904
- SHA1
  
  536b7e85ed8eda9a12e00371fb17df631cb17b3a
- SHA256
  
  84f1733a3efb8dd690c7c7437b967f16a0688d3b4b074e7851a056cdebf6333b
- SHA512
  
  a6e19daf443677e5e65b91cf4f5efec59dfb6ee4345c6fd485f8cdea1eac1ea638c60c310d5b21934659e6d202ca2a8ada409c4576d9d789a239129655c14cb1
- SSDEEP
  
  12288:xoxejOONAM7GUC1Jr+4o628gx2Jw+tP3Jzm8JOtGXCJdw/oX+pd167QhEQO:2xY3NtGUmJr+4Obxd+tPZSZ0/oE6EhE
Score

10^/10

fakeav fakeav persistence spyware upx
- FakeAV, RogueAntivirus
  FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
  fakeav spyware fakeav
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

fakeavspywarefakeav

behavioral1

fakeavfakeavpersistencespywareupx

behavioral2

fakeavfakeavpersistencespywareupx

© 2018-2025

Terms | Privacy