Overview

overview

10

Static

static

10

a301c27e4e...bc.exe

windows7-x64

10

a301c27e4e...bc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a301c27e4e2c05a86785150b325f42bc

  • Size

    2.8MB

  • Sample

    231219-z69sfshba9

  • MD5

    a301c27e4e2c05a86785150b325f42bc

  • SHA1

    bddf6f7ede733fa0bc65d3385952c0e4ecb43c05

  • SHA256

    fbf62a113bd65feeed2d274b1c7cb714f53b5abe949fff7f637bda7e17c17a83

  • SHA512

    7b6bb492895374ab4ed5838adaf7fa3d8abc4361f521654f8ee0a085f7972bdcf69b3af9b0de83b38b391a29e58b39b0c3f34a62df9faa897a3026540f50d8bc

  • SSDEEP

    49152:67N1ahCC0V7N1ahCe0V7N1ahCC0V7N1ahCU0:67v7L7v7

Score
10/10
fakeavfakeavpersistencespyware

Malware Config

Targets

    • Target

      a301c27e4e2c05a86785150b325f42bc

    • Size

      2.8MB

    • MD5

      a301c27e4e2c05a86785150b325f42bc

    • SHA1

      bddf6f7ede733fa0bc65d3385952c0e4ecb43c05

    • SHA256

      fbf62a113bd65feeed2d274b1c7cb714f53b5abe949fff7f637bda7e17c17a83

    • SHA512

      7b6bb492895374ab4ed5838adaf7fa3d8abc4361f521654f8ee0a085f7972bdcf69b3af9b0de83b38b391a29e58b39b0c3f34a62df9faa897a3026540f50d8bc

    • SSDEEP

      49152:67N1ahCC0V7N1ahCe0V7N1ahCC0V7N1ahCU0:67v7L7v7

    Score
    10/10
    fakeavfakeavpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • FakeAV payload

      fakeavspyware

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks