General
-
Target
880cc86d3c1a11124d11409aac3ec07faa6431d839406aa015935d912aaee6e6.exe
-
Size
3.5MB
-
Sample
241124-ggmyaasqdp
-
MD5
48a32861dc86e24074b265d735d63be1
-
SHA1
a4b59535ccf6c36c1d62df21c9ef4b01b6c72fe5
-
SHA256
880cc86d3c1a11124d11409aac3ec07faa6431d839406aa015935d912aaee6e6
-
SHA512
236fa9b9b1d5beef37123c855236faee1e793dabd0f5ca386c9fcc3a8e48eaa9254a5cd3daa8b7656aa82da6a3ba5927667c49d60836725415493feed4907bd6
-
SSDEEP
49152:67N1ahCW0V7N1ahCo0V7N1ahCY0V7N1ahCW0V7N1ahCK0m:67j717l7j7Q
Malware Config
Targets
-
-
Target
880cc86d3c1a11124d11409aac3ec07faa6431d839406aa015935d912aaee6e6.exe
-
Size
3.5MB
-
MD5
48a32861dc86e24074b265d735d63be1
-
SHA1
a4b59535ccf6c36c1d62df21c9ef4b01b6c72fe5
-
SHA256
880cc86d3c1a11124d11409aac3ec07faa6431d839406aa015935d912aaee6e6
-
SHA512
236fa9b9b1d5beef37123c855236faee1e793dabd0f5ca386c9fcc3a8e48eaa9254a5cd3daa8b7656aa82da6a3ba5927667c49d60836725415493feed4907bd6
-
SSDEEP
49152:67N1ahCW0V7N1ahCo0V7N1ahCY0V7N1ahCW0V7N1ahCK0m:67j717l7j7Q
Score10/10-
FakeAV, RogueAntivirus
FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
-
Fakeav family
-
FakeAV payload
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1