Overview

overview

10

Static

static

10

187040a0c4...40.exe

windows7-x64

187040a0c4...40.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    187040a0c45f4384d57c5dd41eb46040

  • Size

    2.8MB

  • Sample

    231219-n13leagbb2

  • MD5

    187040a0c45f4384d57c5dd41eb46040

  • SHA1

    06710f70921ac684271f4b589f6b32d6d7670554

  • SHA256

    6007f66371b539183236450b90dcf712b534fc053f4af5588e9ec1d4227f7167

  • SHA512

    4ffeb215951f607ecdae511d4324d67b3db9740168ba1cac14530555bcebe920845805fc831f12387d1313284e65ddaf6ac5dc57acb1ab0cb7aaf15a7476e0e1

  • SSDEEP

    49152:67N1ahCH0V7N1ahCu0V7N1ahCg0V7N1ahCr0:67K7b7t7

Score
10/10
fakeavfakeavpersistencespyware

Malware Config

Targets

    • Target

      187040a0c45f4384d57c5dd41eb46040

    • Size

      2.8MB

    • MD5

      187040a0c45f4384d57c5dd41eb46040

    • SHA1

      06710f70921ac684271f4b589f6b32d6d7670554

    • SHA256

      6007f66371b539183236450b90dcf712b534fc053f4af5588e9ec1d4227f7167

    • SHA512

      4ffeb215951f607ecdae511d4324d67b3db9740168ba1cac14530555bcebe920845805fc831f12387d1313284e65ddaf6ac5dc57acb1ab0cb7aaf15a7476e0e1

    • SSDEEP

      49152:67N1ahCH0V7N1ahCu0V7N1ahCg0V7N1ahCr0:67K7b7t7

    Score
    10/10
    fakeavfakeavpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • FakeAV payload

      fakeavspyware

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks