fakeav | 17000360c1f9905dcdf66e8bc23a64aa209fc1a729f7390bd272bbad12ee6b86 | Triage

Submit
Reports

Overview

overview

Static

static

17000360c1...6N.exe

windows7-x64

17000360c1...6N.exe

windows10-2004-x64

Sharing

General

Target

17000360c1f9905dcdf66e8bc23a64aa209fc1a729f7390bd272bbad12ee6b86N
Size

724KB
Sample

240922-fgf93asfpg
MD5

b3ca3d549f70794860a45fc82a3134d0
SHA1

48f3f6a0acd7051ff66b4cb0d90957f317cef7bb
SHA256

17000360c1f9905dcdf66e8bc23a64aa209fc1a729f7390bd272bbad12ee6b86
SHA512

832e25f774eca987bade9957b494f64252e336eb3d4e6aec4829db30601983c78b313f361a1ac99945ecb8c7df0d134dc17f752190719ce7c06b0c81d4402b4c
SSDEEP

12288:lB6jfu9W5qVnpA1P9mTx87m7HGA04OBGaSuQalOZeW0dqNOX+pd167QhEQJ:n67MnVnpA1lmTx8MmA07AaSuDSwdZE6o

Score

10^/10

fakeav discovery fakeav persistence spyware

Static task

static1

fakeav spyware fakeav

3 signatures

Behavioral task

behavioral1

Sample

17000360c1f9905dcdf66e8bc23a64aa209fc1a729f7390bd272bbad12ee6b86N.exe

Resource

win7-20240729-en

fakeav discovery fakeav persistence spyware

windows7-x64

13 signatures

120 seconds

Behavioral task

behavioral2

Sample

17000360c1f9905dcdf66e8bc23a64aa209fc1a729f7390bd272bbad12ee6b86N.exe

Resource

win10v2004-20240802-en

fakeav discovery fakeav persistence spyware

windows10-2004-x64

13 signatures

120 seconds

Malware Config

Targets

- Target
  
  17000360c1f9905dcdf66e8bc23a64aa209fc1a729f7390bd272bbad12ee6b86N
- Size
  
  724KB
- MD5
  
  b3ca3d549f70794860a45fc82a3134d0
- SHA1
  
  48f3f6a0acd7051ff66b4cb0d90957f317cef7bb
- SHA256
  
  17000360c1f9905dcdf66e8bc23a64aa209fc1a729f7390bd272bbad12ee6b86
- SHA512
  
  832e25f774eca987bade9957b494f64252e336eb3d4e6aec4829db30601983c78b313f361a1ac99945ecb8c7df0d134dc17f752190719ce7c06b0c81d4402b4c
- SSDEEP
  
  12288:lB6jfu9W5qVnpA1P9mTx87m7HGA04OBGaSuQalOZeW0dqNOX+pd167QhEQJ:n67MnVnpA1lmTx8MmA07AaSuDSwdZE6o
Score

10^/10

fakeav discovery fakeav persistence spyware
- FakeAV, RogueAntivirus
  FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
  fakeav spyware fakeav
- FakeAV payload
  fakeav spyware
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

fakeavspywarefakeav

behavioral1

fakeavdiscoveryfakeavpersistencespyware

behavioral2

fakeavdiscoveryfakeavpersistencespyware

© 2018-2024

Terms | Privacy