Overview

overview

10

Static

static

10

ba6310fddc...71.exe

windows7-x64

10

ba6310fddc...71.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ba6310fddce517e29388d7959d4eac71

  • Size

    2.8MB

  • Sample

    231220-qy6amahdbr

  • MD5

    ba6310fddce517e29388d7959d4eac71

  • SHA1

    04cefcaafc5fd009f0a04c6bd3ea5d7052e10a45

  • SHA256

    33e70a8c1223a7540858a2621810890c7e30e7d29c7ce7939e963527971df856

  • SHA512

    7728ec8ed13e9efe686b0c405e580925cde319c9f65a2c8cbe062c801f5a1db4a2fcdae344dad746741ba585a0ef40c33bbdfcd2639db4d0a18e45d2349d82c6

  • SSDEEP

    49152:67N1ahCP0V7N1ahCA0V7N1ahCN0V7N1ahCf0:67S7N7A7

Score
10/10
fakeavfakeavpersistencespyware

Malware Config

Targets

    • Target

      ba6310fddce517e29388d7959d4eac71

    • Size

      2.8MB

    • MD5

      ba6310fddce517e29388d7959d4eac71

    • SHA1

      04cefcaafc5fd009f0a04c6bd3ea5d7052e10a45

    • SHA256

      33e70a8c1223a7540858a2621810890c7e30e7d29c7ce7939e963527971df856

    • SHA512

      7728ec8ed13e9efe686b0c405e580925cde319c9f65a2c8cbe062c801f5a1db4a2fcdae344dad746741ba585a0ef40c33bbdfcd2639db4d0a18e45d2349d82c6

    • SSDEEP

      49152:67N1ahCP0V7N1ahCA0V7N1ahCN0V7N1ahCf0:67S7N7A7

    Score
    10/10
    fakeavfakeavpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • FakeAV payload

      fakeavspyware

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks