General
-
Target
c1d63b5f3157ebe465bb432448b52233a36d22fcfdfb7df2b3773d35fa812957.exe
-
Size
4.2MB
-
Sample
241219-dl85javrer
-
MD5
9c51f8e5bcb3ac3f2f050a8e1e416874
-
SHA1
ff84ddb468818c822ed0f78ddba9f6ada32e75cb
-
SHA256
c1d63b5f3157ebe465bb432448b52233a36d22fcfdfb7df2b3773d35fa812957
-
SHA512
807bb5197fb1b21e46fa3fa6cc65e4d17e4cfa1a424e6f4661a3081d75d381109fc05ed19e40aa8ebb2b649ce4ecea0130c65523301841b034c4d10c9556f03d
-
SSDEEP
49152:67N1ahCg0V7N1ahCq0V7N1ahC+0V7N1ahCI0V7N1ahC70V7N1ahC/0y:67t737r7V7u7l
Malware Config
Targets
-
-
Target
c1d63b5f3157ebe465bb432448b52233a36d22fcfdfb7df2b3773d35fa812957.exe
-
Size
4.2MB
-
MD5
9c51f8e5bcb3ac3f2f050a8e1e416874
-
SHA1
ff84ddb468818c822ed0f78ddba9f6ada32e75cb
-
SHA256
c1d63b5f3157ebe465bb432448b52233a36d22fcfdfb7df2b3773d35fa812957
-
SHA512
807bb5197fb1b21e46fa3fa6cc65e4d17e4cfa1a424e6f4661a3081d75d381109fc05ed19e40aa8ebb2b649ce4ecea0130c65523301841b034c4d10c9556f03d
-
SSDEEP
49152:67N1ahCg0V7N1ahCq0V7N1ahC+0V7N1ahCI0V7N1ahC70V7N1ahC/0y:67t737r7V7u7l
Score10/10-
FakeAV, RogueAntivirus
FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
-
Fakeav family
-
FakeAV payload
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1