Overview

overview

10

Static

static

10

59cc12b7c5...7e.exe

windows7-x64

10

59cc12b7c5...7e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    59cc12b7c5baf54c3ceb6730cfd8a6f3fc45906223c7d85e94e380acd4e28d7e

  • Size

    724KB

  • Sample

    221202-rka31aee78

  • MD5

    067febe3636e8699874c4c38362683b0

  • SHA1

    3a45e3662c20586d540b33fa18c9ce5c2c78144c

  • SHA256

    59cc12b7c5baf54c3ceb6730cfd8a6f3fc45906223c7d85e94e380acd4e28d7e

  • SHA512

    1c9be6b499b7454ac390d395e240d323c573490e1e58c2b0f1cfb0fd580fe2359a73708050d114cb82b7b2f01f2263e6988c1c1b4a608872f1025b10a2227f8f

  • SSDEEP

    12288:lB6jfu9W5qVnpA1P9mTx87m7HGA04OBGaSuQalOZeW0dgN6X+pd167QhEQJ:n67MnVnpA1lmTx8MmA07AaSuDSwdXE6o

Score
10/10
fakeavfakeavpersistencespyware

Malware Config

Targets

    • Target

      59cc12b7c5baf54c3ceb6730cfd8a6f3fc45906223c7d85e94e380acd4e28d7e

    • Size

      724KB

    • MD5

      067febe3636e8699874c4c38362683b0

    • SHA1

      3a45e3662c20586d540b33fa18c9ce5c2c78144c

    • SHA256

      59cc12b7c5baf54c3ceb6730cfd8a6f3fc45906223c7d85e94e380acd4e28d7e

    • SHA512

      1c9be6b499b7454ac390d395e240d323c573490e1e58c2b0f1cfb0fd580fe2359a73708050d114cb82b7b2f01f2263e6988c1c1b4a608872f1025b10a2227f8f

    • SSDEEP

      12288:lB6jfu9W5qVnpA1P9mTx87m7HGA04OBGaSuQalOZeW0dgN6X+pd167QhEQJ:n67MnVnpA1lmTx8MmA07AaSuDSwdXE6o

    Score
    10/10
    fakeavfakeavpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • FakeAV payload

      fakeavspyware

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks