Overview

overview

10

Static

static

10

875b8458ba...57.exe

windows7-x64

10

875b8458ba...57.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    875b8458ba001356cc65c9957c228a57

  • Size

    4.2MB

  • Sample

    231219-ydyztaefcn

  • MD5

    875b8458ba001356cc65c9957c228a57

  • SHA1

    c70d78d10d18b19ae940a92869145c44a5434f4b

  • SHA256

    8294a8de634f39bd8ac2a37ae3f98a9d519519f7688c5db1417e7263a592a293

  • SHA512

    df2416e5e1091d469705905f513bd5bec82022a826a99f9c2ca20e6c99b72fb262caf2820b40b9c8185541bae8118db9a84011faa329a26b899be8485cf62062

  • SSDEEP

    49152:67N1ahCC0V7N1ahCb0V7N1ahCu0V7N1ahCM0V7N1ahC20V7N1ahCk0:67v7O7b757D7

Score
10/10
fakeavfakeavpersistencespyware

Malware Config

Targets

    • Target

      875b8458ba001356cc65c9957c228a57

    • Size

      4.2MB

    • MD5

      875b8458ba001356cc65c9957c228a57

    • SHA1

      c70d78d10d18b19ae940a92869145c44a5434f4b

    • SHA256

      8294a8de634f39bd8ac2a37ae3f98a9d519519f7688c5db1417e7263a592a293

    • SHA512

      df2416e5e1091d469705905f513bd5bec82022a826a99f9c2ca20e6c99b72fb262caf2820b40b9c8185541bae8118db9a84011faa329a26b899be8485cf62062

    • SSDEEP

      49152:67N1ahCC0V7N1ahCb0V7N1ahCu0V7N1ahCM0V7N1ahC20V7N1ahCk0:67v7O7b757D7

    Score
    10/10
    fakeavfakeavpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • FakeAV payload

      fakeavspyware

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks