General
-
Target
01e782a65c1754e83387ac5aa3adcc4adeb6be257b72456855aefe279b7a7b08
-
Size
3.5MB
-
Sample
240826-wtmklsxhnb
-
MD5
660e8235249b364651c1907aecc53ed7
-
SHA1
6513a1b065184a8405ae6db8b1e4ef4589292767
-
SHA256
01e782a65c1754e83387ac5aa3adcc4adeb6be257b72456855aefe279b7a7b08
-
SHA512
07dc8d7612f2221293460b6a832ab1ae4d47fa9b37508ab788e5a36f21765a1f32dbc2c3fd564e300438309f2a880d67173bcc7fd7fe89a88ea9122847de6487
-
SSDEEP
49152:67N1ahC20V7N1ahCj0V7N1ahCX0V7N1ahC90V7N1ahCK0:67D7W7a7w7
Malware Config
Targets
-
-
Target
01e782a65c1754e83387ac5aa3adcc4adeb6be257b72456855aefe279b7a7b08
-
Size
3.5MB
-
MD5
660e8235249b364651c1907aecc53ed7
-
SHA1
6513a1b065184a8405ae6db8b1e4ef4589292767
-
SHA256
01e782a65c1754e83387ac5aa3adcc4adeb6be257b72456855aefe279b7a7b08
-
SHA512
07dc8d7612f2221293460b6a832ab1ae4d47fa9b37508ab788e5a36f21765a1f32dbc2c3fd564e300438309f2a880d67173bcc7fd7fe89a88ea9122847de6487
-
SSDEEP
49152:67N1ahC20V7N1ahCj0V7N1ahCX0V7N1ahC90V7N1ahCK0:67D7W7a7w7
Score10/10-
FakeAV, RogueAntivirus
FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
-
FakeAV payload
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1