General
-
Target
e2916ce0616f94610a589a179ff866effab60c541a7d6cfd83089793f2a018d8N.exe
-
Size
4.2MB
-
Sample
241219-nscd9atjfn
-
MD5
f8ae333a8aca2cb45f3cf383363e7ee0
-
SHA1
59efd06c29065b13bf2889636223eadc5b60a5ce
-
SHA256
e2916ce0616f94610a589a179ff866effab60c541a7d6cfd83089793f2a018d8
-
SHA512
fa5b50e2c72132c721090ee7f0ecc7b5073c673dada799e1097ee33a668ce2abf287f32ea873f5dc8ffb88907fd899995cff849eec84f12a06f01bd32f45e462
-
SSDEEP
49152:67N1ahCg0V7N1ahCq0V7N1ahC+0V7N1ahCI0V7N1ahC70V7N1ahC/0:67t737r7V7u7
Malware Config
Targets
-
-
Target
e2916ce0616f94610a589a179ff866effab60c541a7d6cfd83089793f2a018d8N.exe
-
Size
4.2MB
-
MD5
f8ae333a8aca2cb45f3cf383363e7ee0
-
SHA1
59efd06c29065b13bf2889636223eadc5b60a5ce
-
SHA256
e2916ce0616f94610a589a179ff866effab60c541a7d6cfd83089793f2a018d8
-
SHA512
fa5b50e2c72132c721090ee7f0ecc7b5073c673dada799e1097ee33a668ce2abf287f32ea873f5dc8ffb88907fd899995cff849eec84f12a06f01bd32f45e462
-
SSDEEP
49152:67N1ahCg0V7N1ahCq0V7N1ahC+0V7N1ahCI0V7N1ahC70V7N1ahC/0:67t737r7V7u7
Score10/10-
FakeAV, RogueAntivirus
FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
-
Fakeav family
-
FakeAV payload
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1