Overview

overview

10

Static

static

10

c6de3fa79c...3c.exe

windows7-x64

10

c6de3fa79c...3c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c6de3fa79c0bb19470aad864385cfebb068b4cacff7752dca4bc71f149a5d23c

  • Size

    755KB

  • Sample

    230129-h5knhadd98

  • MD5

    3a9c0e632afdc428cd5d5eb3a2efdaa8

  • SHA1

    5533de62daf3708adea2da7feafc507053c86c35

  • SHA256

    c6de3fa79c0bb19470aad864385cfebb068b4cacff7752dca4bc71f149a5d23c

  • SHA512

    4fa290a4124ab1ae3c53fa008a30c0dad87c50a24174ccd2dc03307a6af4dea613a45e8ca84e7be919db51af82fc23ea9868534ce47ef20b807dee429e8a97d8

  • SSDEEP

    12288:xoxejOONAM7GUC1Jr+4o628gx2Jw+tP3Jzm8JO3GXCJdw/oX+pd167QhEQO:2xY3NtGUmJr+4Obxd+tPZSZW/oE6EhE

Score
10/10
fakeavfakeavpersistencespywareupx

Malware Config

Targets

    • Target

      c6de3fa79c0bb19470aad864385cfebb068b4cacff7752dca4bc71f149a5d23c

    • Size

      755KB

    • MD5

      3a9c0e632afdc428cd5d5eb3a2efdaa8

    • SHA1

      5533de62daf3708adea2da7feafc507053c86c35

    • SHA256

      c6de3fa79c0bb19470aad864385cfebb068b4cacff7752dca4bc71f149a5d23c

    • SHA512

      4fa290a4124ab1ae3c53fa008a30c0dad87c50a24174ccd2dc03307a6af4dea613a45e8ca84e7be919db51af82fc23ea9868534ce47ef20b807dee429e8a97d8

    • SSDEEP

      12288:xoxejOONAM7GUC1Jr+4o628gx2Jw+tP3Jzm8JO3GXCJdw/oX+pd167QhEQO:2xY3NtGUmJr+4Obxd+tPZSZW/oE6EhE

    Score
    10/10
    fakeavfakeavpersistencespywareupx

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks