General
-
Target
aabe519638f7ce25e5d79697d186105d1acf0bad2c9280636d497aab63fc6d59
-
Size
724KB
-
Sample
240826-bzyjvaxemf
-
MD5
6e11b62276ad2ef7cabfd0a31bdd6798
-
SHA1
ac56165245d2a92b8fc5356259cddfd073cba46c
-
SHA256
aabe519638f7ce25e5d79697d186105d1acf0bad2c9280636d497aab63fc6d59
-
SHA512
eebe47b3a620d2b3b76db2f1a6d7cf9d064b8a3f4e43677712cec82a998568db49f9b9576e58ce9c2b1483148c535ecd7d5c3d3d88d806bc16b84a10b4d876c5
-
SSDEEP
12288:lB6jfu9W5qVnpA1P9mTx87m7HGA04OBGaSuQalOZeW0djNxX+pd167QhEQJ:n67MnVnpA1lmTx8MmA07AaSuDSwdbE6o
Malware Config
Targets
-
-
Target
aabe519638f7ce25e5d79697d186105d1acf0bad2c9280636d497aab63fc6d59
-
Size
724KB
-
MD5
6e11b62276ad2ef7cabfd0a31bdd6798
-
SHA1
ac56165245d2a92b8fc5356259cddfd073cba46c
-
SHA256
aabe519638f7ce25e5d79697d186105d1acf0bad2c9280636d497aab63fc6d59
-
SHA512
eebe47b3a620d2b3b76db2f1a6d7cf9d064b8a3f4e43677712cec82a998568db49f9b9576e58ce9c2b1483148c535ecd7d5c3d3d88d806bc16b84a10b4d876c5
-
SSDEEP
12288:lB6jfu9W5qVnpA1P9mTx87m7HGA04OBGaSuQalOZeW0djNxX+pd167QhEQJ:n67MnVnpA1lmTx8MmA07AaSuDSwdbE6o
Score10/10-
FakeAV, RogueAntivirus
FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
-
FakeAV payload
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1