fakeav | 3568ad621273744637af97198abd1f9d8fab69e88216459eaa0cdbb37a55e15c | Triage

Submit
Reports

Overview

overview

Static

static

3568ad6212...5c.exe

windows7-x64

3568ad6212...5c.exe

windows10-2004-x64

Sharing

General

Target

3568ad621273744637af97198abd1f9d8fab69e88216459eaa0cdbb37a55e15c
Size

724KB
Sample

240702-y6jqlaxdqc
MD5

354b77bc23c34379ac41308e704ce90b
SHA1

548aff35ff491064de8433c625acb324819e732c
SHA256

3568ad621273744637af97198abd1f9d8fab69e88216459eaa0cdbb37a55e15c
SHA512

d8eed022f3a4364b1f2428ce56ebbf5a2e465c0de8bd7ab5c04b7efbd4b36f5f05b662530cc5683c0b72c4d6df8ecc0c5efa9a41f98118bfedecc9bc6f85a2a1
SSDEEP

12288:lB6jfu9W5qVnpA1P9mTx87m7HGA04OBGaSuQalOZeW0d3N0X+pd167QhEQJ:n67MnVnpA1lmTx8MmA07AaSuDSwdmE6o

Score

10^/10

fakeav fakeav persistence spyware

Static task

static1

fakeav spyware fakeav

3 signatures

Behavioral task

behavioral1

Sample

3568ad621273744637af97198abd1f9d8fab69e88216459eaa0cdbb37a55e15c.exe

Resource

win7-20240508-en

fakeav fakeav persistence spyware

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

3568ad621273744637af97198abd1f9d8fab69e88216459eaa0cdbb37a55e15c.exe

Resource

win10v2004-20240611-en

fakeav fakeav persistence spyware

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  3568ad621273744637af97198abd1f9d8fab69e88216459eaa0cdbb37a55e15c
- Size
  
  724KB
- MD5
  
  354b77bc23c34379ac41308e704ce90b
- SHA1
  
  548aff35ff491064de8433c625acb324819e732c
- SHA256
  
  3568ad621273744637af97198abd1f9d8fab69e88216459eaa0cdbb37a55e15c
- SHA512
  
  d8eed022f3a4364b1f2428ce56ebbf5a2e465c0de8bd7ab5c04b7efbd4b36f5f05b662530cc5683c0b72c4d6df8ecc0c5efa9a41f98118bfedecc9bc6f85a2a1
- SSDEEP
  
  12288:lB6jfu9W5qVnpA1P9mTx87m7HGA04OBGaSuQalOZeW0d3N0X+pd167QhEQJ:n67MnVnpA1lmTx8MmA07AaSuDSwdmE6o
Score

10^/10

fakeav fakeav persistence spyware
- FakeAV, RogueAntivirus
  FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
  fakeav spyware fakeav
- FakeAV payload
  fakeav spyware
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

fakeavspywarefakeav

behavioral1

fakeavfakeavpersistencespyware

behavioral2

fakeavfakeavpersistencespyware

© 2018-2024

Terms | Privacy