��}�rɉ�Qy(��쵠��$���v��_�J�#,�H��I(QO�_��P�'�p?S:�B��l�~��F(�,>��[�SQՏH\h��]�q�*/���[=���*Z5�����`��&+o���7�=�M�Ύb��]l1���z�tt�������SY�CK�2�$7�m�@u�i��s6O!C�R(�=/��:}���`�9\��c�\a �����)�M�����p�;�5r|P�`���0�w��ah34�Tj ��6� M���3��e��m�T���s.��)x����p6���L(�{ωe�RM�d��pe�*��:O�E���������O�����\l�S�(� 2:�n�T7� _z�?�H��l �!�Zy�5!�����و���G��6M��>g~�=�V^���ͻb����#�$��Ig�'9�K���&;�5���!��>�k|��S�K��8��Qہ�u�#'�� I�Y�<�9b��U��el;�+^kg�NnRQ�������m�Ìx� vGW�D�{��-����m�����Z`�f>�a���Pa�����&���Ze_1���]����K���`ڈ������d`m%�G���.ɺI�����a�3U�i�>�1X�`&��0wY<�`��'5P�d7�_+���Zad���8�߈�1� �n��r�:-F��R��J�u&����(���]d�K�g�il�ʲQ����r�5�콱���èP7��@Q{p��+`�>�jG!䌽a�u��}%������ X��9��}�;.Y�6��|:H������;2��>�AL��ljj8`��o�����������a��U�(貸/MիY��YUD�� .Q�nr����"p�����I��<ű�%�R�R9���2i#LB�Q�)�??���-_�p�N�^���}�OO�?��jWN��|g��E������%������i&W����ow˅�?v5Ev��ݵ�/���K<%UkEtC\uWP�G,�9�ҏ������5l�tK/OW�e_���1�BC.���wϕ?�@�3oK�k��W�Y!�d<S�Ƹ���N�����5�T��LXtw�<��,��h�px'��̃n*���r�W;�U����I�]�bw��}G�ō��5jU ��;�ɥ)?'���vj��xt��k�[4�QJ���%��Zv�dȟ���p�����\��m��@%t}d.��]��3�� S�4����4E]劖�ž@� |=|��?Ew�'�}#��UX ��5��[��-w��#]rn������IQ��tR��K;��������� ���y���+���\�݇�A\e��w;�0B~�( p�'ُ�ᰔ���2A�#*\މ0�F�=��r���d) ��l�P%�����7�cW_4_M��j��,��3������w�[;h<��t��f}�����o`��֧����G�#���ôL�H)�!|eͧ�����-0۶g:�QS��^�lv�������Q֒d(��cά��9V�P��t���}0���Úw}�9�'�[Uΰ�gy�0j�Ķ}�L1�����?ގ]o=�������L�|�=_�5�8 �p.>F��fb��&6���)�ߏ��e�6�x��3ʤ��<���߹��r_X�嗮���Ϫ��yf��]Y�<��$�c�)f�KK��o-Ե�iX2�4n���E�� }��s����;���-���f�������X����]C�ztZ)<�������tWri�@פcT�(yw��I�s8�{˲���gZ��ɧ��ځVЯ�ƺmu���>�%�R�ɇ| �r���,� 36<Š&�7�%M���&���&�����R�ub@��BC�� /�j�)%��S�2�T���q��^|����X�:��`|��A]c" �F�A1uy�#��U����c���e�^���֬u�+vV�/�l��/%�q*Zk�ş"Րܥ*��f�>)�9칯<}�~�ԺʶD y�b����;(��E�@S�� �n����0K<���Q �/i�^ |��t>�œ�U�^Z�bW!�'�V��9E����S�f�X�+ɡ��)���~J}7�,��\6���x�2P�ݳ��%����[�n�W�p0�$�$��w�Vkl�_B�u��h���*o,��i�q�%�Ed)%uLW)g\4rrmN�|����ҩ������b��!��Č:f�1◽�ڣ�^v.j4�����j�����qj��y����ꏵf��IJ_���)�hKj����;Q��� 8���%��u4��kWD�4��S@aԀ�y+��}۞���{��i^�Vܾ�Ф���!rC[ 6>iTڙ1�/wU����0����3�P���+���KN�3w���E��⦜Xޝ�T�. ���ҥ��L|J8��O&���1Q��ka��T�,��=ѻ�]W�w��L�w��9%�i��)���>i�8�������A��,\��w�'Df§� \hV8$6�N��,1nS�9Y����8X?iaT�������}B�ey�ȍ���/*<�k\-�a��I�Jͬ��<�a�'�/�e��ec�;�^�Σ�v�vֵ�� ^�pA;ت�݆�k�Q�|FV"�B#���0�8ϠBV���jS���Y���J{��iΣtͅ����rvDZ����:�_�?�ǀ��F��<�4!4�+@4�Y�X ���2G�Ko�B�����dma�á�U5��v�/�\����������W+~�35�O�GVsP��˂vִ�{n9� ּ�C܆bS��(����| Y�ֿ�Z\����T+��E�������\�����`9��C���VJ��n�G�q�4� 7�jq�f�����' z_W�4�:�@e���N:m�� �� TN��8�(3L2p>y���Bn ���!��KVn�����X�fE����Dij=_'�C�8AQz��+��p��(�.�VN�b�X܇;���W��*N�;dDѧE��P�fk�Y-��H���wRMx#����IV��(g���;�������ߕŦ�A��^�, (�[�������ke����$�O��Cܕ�SR��
Static task
static1
Behavioral task
behavioral1
Sample
VixenCleaner.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
VixenCleaner.exe
Resource
win10v2004-20240802-en
General
-
Target
VixenCleaner.exe
-
Size
4.9MB
-
MD5
af8f8587821143b7255200ebe32d0d2b
-
SHA1
b01be2b6d0a9b61bceda337aaa2becc2694d14cb
-
SHA256
8a7d133f073b8582009973807cebaa9e454e967f9b09c0b8a9986e09348b4363
-
SHA512
fa69ead0229174ea503562ab8855e45ed62dd0e261bb21afb41c4e68ab87bf9f931dc0eeb94e0d2d5661872f32b9a6ac84bd78bb9fd855a44da65bfa1725e478
-
SSDEEP
98304:5X05UqcGniC73JFgCZanOPRRXDZTdtV8urNx/BSW4Z7Uv+:GUqziC73JFgCZanenTZTdjh7h4lUv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VixenCleaner.exe
Files
-
VixenCleaner.exe.exe windows:6 windows x64 arch:x64
df501a002db8c0d0df5423490c74f685
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
HeapAlloc
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
RegOpenKeyExW
ole32
CoInitialize
msvcp140
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
iphlpapi
GetAdaptersInfo
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
toupper
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-runtime-l1-1-0
__p___argv
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vixen0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vixen1 Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ