Overview

overview

10

Static

static

10

NEAS.3db29...f0.exe

windows7-x64

10

NEAS.3db29...f0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.3db29c8cdf2c03dcf5aaced492645bf0.exe

  • Size

    724KB

  • Sample

    231111-aangxabg92

  • MD5

    3db29c8cdf2c03dcf5aaced492645bf0

  • SHA1

    01e75a0272d4dcd310827d18fc100c0cfc993307

  • SHA256

    726518ba4c4d074dd869e8d152621084fff18d2caf8470e8eda20240f581f34d

  • SHA512

    00d79019a989a57e5724c4e8c762ec9c2273401b286fd8a8567267cc5e4652958e6116390aac7d555f1c52c98e1a640950f1264af8ff4dbd573741a29b85b068

  • SSDEEP

    12288:lB6jfu9W5qVnpA1P9mTx87m7HGA04OBGaSuQalOZeW0dbN0X+pd167QhEQJ:n67MnVnpA1lmTx8MmA07AaSuDSwdSE6o

Score
10/10
fakeavfakeavpersistencespyware

Malware Config

Targets

    • Target

      NEAS.3db29c8cdf2c03dcf5aaced492645bf0.exe

    • Size

      724KB

    • MD5

      3db29c8cdf2c03dcf5aaced492645bf0

    • SHA1

      01e75a0272d4dcd310827d18fc100c0cfc993307

    • SHA256

      726518ba4c4d074dd869e8d152621084fff18d2caf8470e8eda20240f581f34d

    • SHA512

      00d79019a989a57e5724c4e8c762ec9c2273401b286fd8a8567267cc5e4652958e6116390aac7d555f1c52c98e1a640950f1264af8ff4dbd573741a29b85b068

    • SSDEEP

      12288:lB6jfu9W5qVnpA1P9mTx87m7HGA04OBGaSuQalOZeW0dbN0X+pd167QhEQJ:n67MnVnpA1lmTx8MmA07AaSuDSwdSE6o

    Score
    10/10
    fakeavfakeavpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • FakeAV payload

      fakeavspyware

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks