Overview

overview

10

Static

static

10

78554063a7...25.exe

windows7-x64

10

78554063a7...25.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    78554063a7079b6427d5e69d1e0af325

  • Size

    2.7MB

  • Sample

    240126-zd8ppadhf3

  • MD5

    78554063a7079b6427d5e69d1e0af325

  • SHA1

    651e0cfdf346b85f94b6991d9f1b1dbf36f4aa9a

  • SHA256

    faa3745f1a2990d407446e99e216e75f4306b814159247ce2866ea5f978c6beb

  • SHA512

    6152faeee176fef058f106cd6aabdf001f1d253dd5d63bf194e7d679e6574b6e0462d016ed93127b30e8258562b275819888439418915d1d5499b9c348ceb19e

  • SSDEEP

    49152:67N1ahCA0V7N1ahCR0V7N1ahCWF0V7N1ahCK:67N7E7W47K

Score
10/10
fakeavfakeavpersistencespyware

Malware Config

Targets

    • Target

      78554063a7079b6427d5e69d1e0af325

    • Size

      2.7MB

    • MD5

      78554063a7079b6427d5e69d1e0af325

    • SHA1

      651e0cfdf346b85f94b6991d9f1b1dbf36f4aa9a

    • SHA256

      faa3745f1a2990d407446e99e216e75f4306b814159247ce2866ea5f978c6beb

    • SHA512

      6152faeee176fef058f106cd6aabdf001f1d253dd5d63bf194e7d679e6574b6e0462d016ed93127b30e8258562b275819888439418915d1d5499b9c348ceb19e

    • SSDEEP

      49152:67N1ahCA0V7N1ahCR0V7N1ahCWF0V7N1ahCK:67N7E7W47K

    Score
    10/10
    fakeavfakeavpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • FakeAV payload

      fakeavspyware

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks