Overview

overview

10

Static

static

10

6f32cef9c9...40.exe

windows7-x64

10

6f32cef9c9...40.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6f32cef9c909efb55da2edbaf96ca840

  • Size

    2.8MB

  • Sample

    240122-kd32waceh9

  • MD5

    6f32cef9c909efb55da2edbaf96ca840

  • SHA1

    a6f2f469570369e58780a3cbb9edcb6b671fe4d4

  • SHA256

    a31efbc0b3dd4be4a6fb98637ae419054c11133b4d24f21dbf4fcf7bb71d4816

  • SHA512

    33c1b1951356066827c652838009571179b259945518f633bcf0053f1ed5b2729ce5e98de65dde794d38dd4edb9d98378b55d4508a0f6885cabb1ac216d36a9e

  • SSDEEP

    49152:67N1ahCV0V7N1ahCW0V7N1ahCt0V7N1ahCX0:67I7j7g7

Score
10/10
fakeavfakeavpersistencespyware

Malware Config

Targets

    • Target

      6f32cef9c909efb55da2edbaf96ca840

    • Size

      2.8MB

    • MD5

      6f32cef9c909efb55da2edbaf96ca840

    • SHA1

      a6f2f469570369e58780a3cbb9edcb6b671fe4d4

    • SHA256

      a31efbc0b3dd4be4a6fb98637ae419054c11133b4d24f21dbf4fcf7bb71d4816

    • SHA512

      33c1b1951356066827c652838009571179b259945518f633bcf0053f1ed5b2729ce5e98de65dde794d38dd4edb9d98378b55d4508a0f6885cabb1ac216d36a9e

    • SSDEEP

      49152:67N1ahCV0V7N1ahCW0V7N1ahCt0V7N1ahCX0:67I7j7g7

    Score
    10/10
    fakeavfakeavpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • FakeAV payload

      fakeavspyware

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks