(�3��4?7v6-���.G�������W��H&�e��G���9�҇8o�ޣ�2#�'���+������X�R{�B���K9�!�(�=��D�E�}�e�X�!�Ϛ͚U��9�atH�%-WRs���=��m$�����X��4(��D⸬�=�>��^-h��jh_����.C��i2WP�pb2�ѹ��̷��=����1S�d��ʲn� ڦD7�m��m�Oc�zO�Y�l���xx�YL>�(�c! ��Ej��o#L�pT�u}u���*2D�j$<�(�l�կ+1)�w���y���)z��]N���{��D� �^�5�k-ӳ��W����E�a�|����.�UM/�w T�F.-�){�f���M=A5n�nϘ�&Xf�jsN�e lB7V+۟��b�6��^���4\?�!��!Uy>TJDm�?�)?�9���r�Ԩ�@g�h�Xk,TKE����8C���?{�xY�����9[�6�M�$j�����P���f��գH��+��5��߮ �5"*ǥZ6F73����L{y@ChEc����s�h!C�uq�dض`�|���ݷ�s`��Őa5�t2#)N�i?$�Y������`,6�$/�'�k���p�7�����%�f��rl��Ԏ��ܭ�i-�M�ꦧ��}��&&�t���:W#�F�4u�Ft�J$�XX����7�l�;a�9��j��x����{���3�2~�D �)��Q���]�K�����h��L���C�7�~ξ��.|\��$��f��W5�A���VazF�����5�ɂ����&�"�#�9�`�Hs9���m�s/���C�CZ�S� 1��������E�3߆�,FFEËs]N�]:dc]q)�Rk{� *�BU��7fǴR�� U��\������^t�����o܋��j�.���n�> @k��"��3#ټ�>���@��;%����2��v��ï�� KSi��恛��^�N�U�?��6!��@�Sq����#�j`��D�?��� e��<���������eVw ��.(b+Rn��٘�K(ٴ�z2�;G��2�aT���u��3���9q���G.=�@ԫ�6�(�BPY|�.�h���͙ ��z��d �,����u}R®ϭI3g�g| �����gRN�]�@�ֹ#��`ó��'p���_�����[ā�`)O��I��?Ӵ���<��]��M0ǰX�s �}� �p� �z2�Е��ِ&p~�Y���i��|c�Q��2���>�!���dk�{��0ձ<�����u�LlhY�u�����#J ^ʦվ#X����B�]Xy\�'��5���!��SU8k �����wv�S�]��ov�pL꓆H�.|=珏�Fe�!�-����������|g�}��9p�-T�X��?8�mR�-���DB����WOWq�ɚ/�=, Z���<��c�\�B�L`N�@�e�鄚/����ŋ�� �8�[���7#��*������]�ǘ��F�4��"�.�V:N��c�a�}T ��:dY���)~�FO�2���d��OS�(� hHQ��VN&�x֖�"�~M����J�]���};E��Cl��������[��u���wC�D5]������x%5���*���4�F�e�b�j�Z���%�F��钅�u =�(���Fڅ�Y�p�j���������f0N$��E��eK4^ːF�r~���m{�7pҹn6���v�KY�ܩ�Rb�ʈ��!3���^2�h��+�Z� ��ҷHX2����%Q���]h\�]x,�P5<rи/��_�"�J���̬o� ;~Ncs��X�!g) ��#ˇO�.�c��]|�ޘ�P��l��CEa%sQǥ��ၷ�9L��U�-D�R�ͻP`W�P��|�[��. ���l���7���z�e<��*�V�����,{�?3h��/댺�@1��y1���=9��i���#S����yy��q��Xm]t�o��w��V�\�\���%����Em�Yi1����6������3͉n�G�J���i�����2��J;��2�c���Y�AN��� �N�\Z*L+��/�Tk�x���7�L���5���[R2Ǿ�*:kmn���`P��AЏЅo�8�Y��Lz6_~��-0�@�%M�����"����Zr�D���~t�6����a���Y'�1)��&}Q�kp@Xſ.��a��J�5AZ�C�L-����{B.e�&|{�e�z�R�{^�����UH;$q<�f���,�%Ѿ�!&IVk��N�U�{�A�}`�E/~�3Nc��iԣr��Y�;��5kyDŽg���P˽aS�Jh�v֧�w����鸭���4�H)m����t��2=���Wͣg/��pw�R�����<���503�*�X��T��l����C���I�.0������,���j"$�B����&b������TG���X����lM�)�w�@��u *g�Fo���:��yF�I�"��� �%L1:u)�(��t�N[!���o�:��}�pۤ�F=��f����b����4�X��[ +x�S�3�����4����`W\�bQxh�Є��V���X�"�pJ�$���@���ڇ/�XB�:8f]J?LC*��z�~W�M���{pHNIY]����G��[N�z4B���Ѥ�͚E��;}���:���~��GjM:A6o8��iy��}��;���:\�P�����1��Èw�!t[ڲfv{�.��,����aM����������nw���E!3����&��T^�ă2���E�q��&��$ʚ�kp���ɣ�6�<m�%y^�&��6�_3�2�:�� F-��|q�N�|mU$�0[���ٜ1��p~�'��]�~F�[�u�R��a�h#�-���r_e������k���r�0�P��XՋR#Y.��'p����(SjtV��MgCF�f` ��;aEYB��Z.������t:��%���b�Ul�FNٲDZ����!@� b�{�+oӋ���� .���w1��(�/`��DC��S��>[,�p��?�9�R�oލ5�9d�2]g
Static task
static1
Behavioral task
behavioral1
Sample
VixenCleaner.exe
Resource
win10v2004-20240802-en
General
-
Target
VixenCleaner.exe
-
Size
4.9MB
-
MD5
10a3c900dc1e7f1b0bee693260c6bb3c
-
SHA1
7ab7aa83d4619e03495e1a136650bd4a6ca97727
-
SHA256
137f34c48c8ae6a3d572f8e98fbe1f5f779c29f4a2ab96aa7c61d72cdacfbb9b
-
SHA512
2bf2e4ad969c62f0fa3d45dc5cc825c2ed7ca18b62c0e923e04c09375c3e40641a08f571f49b45c1ed8a9a80b56c5691e6e793e9c866b7cffd00e0fbb77276fb
-
SSDEEP
98304:81qdsyUQF2ZFh3K1gOWhMfkOlpns0IUrm7f3GiiUcbtZP/2:qTHQF2nb5CM90Ia8GHUcbtd2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VixenCleaner.exe
Files
-
VixenCleaner.exe.exe windows:6 windows x64 arch:x64
9cce13405448de0c69c4a82a5d3b2aad
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shell32
ShellExecuteA
shlwapi
SHDeleteKeyW
kernel32
GetLastError
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
RegEnumKeyExW
ole32
CoCreateInstance
msvcp140
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
iphlpapi
GetAdaptersInfo
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
ceilf
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 176KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 170KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vixen0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vixen1 Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ