General
-
Target
ba2553e86e770a86cfa077b73d830b7d75ac16e62d90cc3ff8fc8ae23a0e0696N.exe
-
Size
724KB
-
Sample
241130-qz4s7avqbv
-
MD5
e6bcaea70c65bd5087fd6d80511d2100
-
SHA1
0ef5226cacb21101c9a8f49d9b51d07da474a7d0
-
SHA256
ba2553e86e770a86cfa077b73d830b7d75ac16e62d90cc3ff8fc8ae23a0e0696
-
SHA512
477d402b1a6e849817adc2c1ff2d78081c71d1982aa15713980c6bf716f31fea33319041820e4a5170917d214b0294e1856d9e75040ba0c88351dfc03619d469
-
SSDEEP
12288:lB6jfu9W5qVnpA1P9mTx87m7HGA04OBGaSuQalOZeW0dfN4X+pd167QhEQJ:n67MnVnpA1lmTx8MmA07AaSuDSwdKE6o
Malware Config
Targets
-
-
Target
ba2553e86e770a86cfa077b73d830b7d75ac16e62d90cc3ff8fc8ae23a0e0696N.exe
-
Size
724KB
-
MD5
e6bcaea70c65bd5087fd6d80511d2100
-
SHA1
0ef5226cacb21101c9a8f49d9b51d07da474a7d0
-
SHA256
ba2553e86e770a86cfa077b73d830b7d75ac16e62d90cc3ff8fc8ae23a0e0696
-
SHA512
477d402b1a6e849817adc2c1ff2d78081c71d1982aa15713980c6bf716f31fea33319041820e4a5170917d214b0294e1856d9e75040ba0c88351dfc03619d469
-
SSDEEP
12288:lB6jfu9W5qVnpA1P9mTx87m7HGA04OBGaSuQalOZeW0dfN4X+pd167QhEQJ:n67MnVnpA1lmTx8MmA07AaSuDSwdKE6o
Score10/10-
FakeAV, RogueAntivirus
FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
-
Fakeav family
-
FakeAV payload
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1