7f95f79293c94b9265b59f44b290e5d3135f1784220eb48a002099db4a4ce28a

General

Target
VixenFreePerm.zip
Size 293KB
Sample260717-tkkcsaay5v
SHA256 7f95f79293c94b9265b59f44b290e5d3135f1784220eb48a002099db4a4ce28a
MD5 2d915b229e3d7107d4ae750ac3f22a69
SHA1 2fac4cbb1ffe18c06f2cd82da17633a2b334558d
SHA512 d8ae74021197a41cba970de1c65ed8d34e3a089959bc637f9b59aa85ab033f9f6c71a4f51f2174f64fa69193b688ce3c485e679656f81b4afdcac1aa25034cb4
SSDEEP 6144:rs1UHTVTZuyxhpq0wyQ83uQd8leaUjIOxjL5J5sv39:rMUHTVTIyjpq0wZ837dYHUjtxpK
TLSH
T1BD5423CA9180EBF15997E2A6CD9661604CB21F717684670FE78C67F71BEBB8AF704004
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  VixenFreePerm.zip
- Size 293KB
- SHA256 7f95f79293c94b9265b59f44b290e5d3135f1784220eb48a002099db4a4ce28a
- MD5 2d915b229e3d7107d4ae750ac3f22a69
- SHA1 2fac4cbb1ffe18c06f2cd82da17633a2b334558d
- SHA512 d8ae74021197a41cba970de1c65ed8d34e3a089959bc637f9b59aa85ab033f9f6c71a4f51f2174f64fa69193b688ce3c485e679656f81b4afdcac1aa25034cb4
- SSDEEP 6144:rs1UHTVTZuyxhpq0wyQ83uQd8leaUjIOxjL5J5sv39:rMUHTVTIyjpq0wZ837dYHUjtxpK
- TLSH
  T1BD5423CA9180EBF15997E2A6CD9661604CB21F717684670FE78C67F71BEBB8AF704004
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  AMIDEWIN.exe
- Size 300KB
- SHA256 da35eabcd2ae42e0fe975454464eaef167156078e1260222127338ebc6e54473
- MD5 2b34156ed9893c771720273727607535
- SHA1 359f5c16a8f2c7e91e2b008b8cd62972ee6110e2
- SHA512 0fd4b41b7b9508ab407851bc5864527da68268040214a58106288fcb4f034caad4bc34a88570e7b6002a619a85414b1c8c8a871b60c85907f80d6d9c4d672f5c
- SSDEEP 6144:3CEHDrlz6+pK1NZzTu80d6P7NmNa5ElD:yKDpSD7NmN
- TLSH
  T188643900E502C030E4B200FD949B5FA89E686459675887EBB3FCD9B9AF631C59E7731E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  AMIDEWINx64.EXE
- Size 377KB
- SHA256 47c16703fa7df006f9559fca8b1482b4c59111017a0530c1edac3caf0bdaaf39
- MD5 6dea36ae7a414e376b00829e16da52e0
- SHA1 5ddb6b72867002a03f26aed612f320e82598464e
- SHA512 f61f6a661e816ff72a91849c8363dbbbadadc24d34c25072a3cbb3be16ce9a540c8f86ae2c031fc97e5484944d8957cd7a7e3104dee2a2091b2b344422e30487
- SSDEEP 6144:u0lLNvLmP/LgoYG5HViOlHH7qKPUcky2FpwhPa24UW3Plqr9hUURgr:lzmP/Lgk5HViOlHH7qKPfky2FpwhyV3X
- TLSH
  T10084F66AEB9220F0EC77917C88922306FBA075684771D7E7B7AD450A4F337E4A939710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  AMIFLDRV64.SYS
- Size 29KB
- SHA256 65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9
- MD5 f22740ba54a400fd2be7690bb204aa08
- SHA1 5812387783d61c6ab5702213bb968590a18065e3
- SHA512 ac1f89736cf348f634b526569b5783118a1a35324f9ce2f2804001e5a04751f8cc21d09bfa1c4803cd14a64152beba868f5ecf119f10fa3ccbe680d2fb481500
- SSDEEP 384:qvOTI5HIPy54ygZOq0HMMKf69JG8QnuOfZFnJtQSZsHLPK6jjMYiWPFRUI5xl9Wn:qvsUoK54ZCMMb9U82uO7Jt6PKg4YHUc+
- TLSH
  T1EFD23B92C6B45C87EEA3993162F4D263BD35B69237608ADF4026C0950F93BD1A73C369
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4
- Target
  PSWOA - run as admin to spoof.exe
- Size 89KB
- SHA256 98ffd1ecff2ae90c51dfa29ad8bf4d7b3dcb029560f5493bb5ec0c06320fccd7
- MD5 b8c06bce0b2e9eecf3d5e8c52655fa22
- SHA1 74f656d970f994cf5563b3c0de7b4f72438cf217
- SHA512 647d85aed43e66ac6e29906598d2dec0cea4eda57c8ba0a6b22156b21d559c7a34ca4de668a000ec072d61371100a337c1643b4419093aee723de5977f292fb9
- SSDEEP 1536:cbu0aJTiGq+zQ08XPPZ/0Jx6FxbF9S/Rp:NJTiG38fP+JxuS/T
- TLSH
  T19093A52EEC67A63AD7905DBD403A42C6F706F58EDF994E36A7E948E608019DC1F21D03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion execution
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral5
- Target
  amigendrv64.sys
- Size 36KB
- SHA256 811e5d65df60dfb8c6e1713da708be16d9a13ef8dfcd1022d8d1dda52ed057b2
- MD5 9accebd928a8926fecf317f53cd1c44e
- SHA1 d7d71135cc3cf7320f8e63cefb6298dd44e5b1d4
- SHA512 2563402cc8e1402d9ac3a76a72b7dab0baa4ecd03629cc350e7199c7e1e1da4000e665bd02ac3a75fd9883fa678b924c8b73d88d8c50bf9d2ae59254a057911e
- SSDEEP 768:cBOmh786zi+NqkO8Ouwn3uivOyiRZSFInq1os29zjTUD:cXi+NXwnecOyiaFInq1lCz+
- TLSH
  T1F6F27CC25B7824C6ED97993082E8D673BC71F6A61B1083EB01B0D0251E93FD16B3922F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6