General
-
Target
c390cfd9572450c05a7cec14a350362f95c5b9f44c5fa7aab1e286ffb1e25eff
-
Size
8.5MB
-
Sample
240805-c5hagsvbpl
-
MD5
c3b62637d3601e80da8080c3488b4d91
-
SHA1
de379e7cdfc586fb42cc7932b1c68ca7305b0efb
-
SHA256
c390cfd9572450c05a7cec14a350362f95c5b9f44c5fa7aab1e286ffb1e25eff
-
SHA512
b0a0cfa1cacbea4d9f8664e62bf42669caa7ed7f4929cdcf417ad313d516e3a2db9864cb8cedb9d6fe3556c8fefb09010047449b9a73c2f339cd63242c3796fc
-
SSDEEP
49152:67N1ahCU0V7N1ahCk0V7N1ahCG0V7N1ahC+0V7N1ahCl0V7N1ahCH0V7N1ahCY0M:67B7R7T7r7Y7K7l7A7A7I7I7
Malware Config
Targets
-
-
Target
c390cfd9572450c05a7cec14a350362f95c5b9f44c5fa7aab1e286ffb1e25eff
-
Size
8.5MB
-
MD5
c3b62637d3601e80da8080c3488b4d91
-
SHA1
de379e7cdfc586fb42cc7932b1c68ca7305b0efb
-
SHA256
c390cfd9572450c05a7cec14a350362f95c5b9f44c5fa7aab1e286ffb1e25eff
-
SHA512
b0a0cfa1cacbea4d9f8664e62bf42669caa7ed7f4929cdcf417ad313d516e3a2db9864cb8cedb9d6fe3556c8fefb09010047449b9a73c2f339cd63242c3796fc
-
SSDEEP
49152:67N1ahCU0V7N1ahCk0V7N1ahCG0V7N1ahC+0V7N1ahCl0V7N1ahCH0V7N1ahCY0M:67B7R7T7r7Y7K7l7A7A7I7I7
Score10/10-
FakeAV, RogueAntivirus
FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
-
FakeAV payload
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1