General

  • Target

    Paid_Method (1).zip

  • Size

    23.7MB

  • MD5

    18be36c767c5887e39a4698750ffb068

  • SHA1

    bd1a9bce833f9d8376d0e9873911df0b757ef2fc

  • SHA256

    c2f01c04aa6bae157e7aa95eb2c93c07e1613cb9486e7e45f1dd0c563117ab54

  • SHA512

    9ef533d6b133152cfa83c553b36feda64db3bb5fab578c0988f68554caeb5c93a4be4a74ae870366d58fe8460b343a4f01d135da718cf2c22e4d12d7ee133ab8

  • SSDEEP

    393216:P5qmWebsBOHf8oUiBpOaEoYjWnsbSx7mGn+AqxPctO3VJS7:PWebsc6iBsa4WnsbheqxEp

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

Files

  • Paid_Method (1).zip
    .zip
  • Paid Method/Cleaning/AdvancedLogCleaner.exe
    .exe windows:4 windows x64 arch:x64

    f326f88ca83c9aacaa44acfb8884f1d4


    Headers

    Imports

    Sections

  • Paid Method/Cleaning/KatCleaner.exe
    .exe windows:6 windows x64 arch:x64

    4a663d7a1bcccad201f7cdf0a50ca9ed


    Headers

    Imports

    Sections

  • Paid Method/Cleaning/NXT_Cleaner.exe
    .exe windows:6 windows x64 arch:x64

    00bb10a457425746b36936c13a25d800


    Headers

    Imports

    Sections

  • Paid Method/Cleaning/godcleaner.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Paid Method/Spoofing/!RUN TO PERM SPOOF.bat
    .bat .vbs
  • Paid Method/Spoofing/AMIDEWIN.exe
    .exe windows:4 windows x86 arch:x86

    e4bef79f59242df9daf28c2c8193c40e


    Headers

    Imports

    Sections

  • Paid Method/Spoofing/AMIDEWINx64.exe
    .exe windows:6 windows x64 arch:x64

    ed928bd060b03bab412d37a11b9d26a0


    Headers

    Imports

    Sections

  • Paid Method/Spoofing/DMI16.exe
  • Paid Method/Spoofing/DMIEDIT.exe
    .exe windows:6 windows x64 arch:x64

    9bbd972bee7030506f62236dff565e85


    Headers

    Imports

    Sections

  • Paid Method/Spoofing/DriverLess.exe
    .exe windows:4 windows x64 arch:x64

    f326f88ca83c9aacaa44acfb8884f1d4


    Headers

    Imports

    Sections

  • Paid Method/Spoofing/HWIDchecker_1.exe
    .exe windows:4 windows x64 arch:x64

    f326f88ca83c9aacaa44acfb8884f1d4


    Headers

    Imports

    Sections

  • Paid Method/Spoofing/UCOREDLL.DLL
    .dll windows:4 windows x86 arch:x86

    6b893ca0388ae7a60f134fafc899b16d


    Headers

    Imports

    Exports

    Sections

  • Paid Method/Spoofing/UCORESYS.SYS
    .sys windows:4 windows x86 arch:x86

    072f277c4d89044b84c482307008a355


    Code Sign

    Headers

    Imports

    Sections

  • Paid Method/Spoofing/UCOREVXD.VXD
  • Paid Method/Spoofing/UCOREW64.sys
    .sys windows:4 windows x64 arch:x64

    0dcd262801389f839ce909cb173448e2


    Code Sign

    Headers

    Imports

    Sections

  • Paid Method/Spoofing/Volumeid.exe
    .exe windows:5 windows x86 arch:x86

    196b8047c609ccadce7fd294c9a3e6a2


    Code Sign

    Headers

    Imports

    Sections

  • Paid Method/Spoofing/Volumeid64.exe
    .exe windows:5 windows x64 arch:x64

    735aed1002ee8ff1be0e1dee668e8b0d


    Code Sign

    Headers

    Imports

    Sections

  • Paid Method/Spoofing/amifldrv64.sys
    .sys windows:6 windows x64 arch:x64

    363922cc73591e60f2af113182414230


    Code Sign

    Headers

    Imports

    Sections

  • Paid Method/readb4using.txt