bc26fd5f60834276b009d02a42e14a5ea5a02b059a4606069798751c18b69b43

General

Target
Vixen.Free.Temp.zip
Size 72KB
Sample260727-ts7s2shr5t
SHA256 bc26fd5f60834276b009d02a42e14a5ea5a02b059a4606069798751c18b69b43
MD5 28aa9337c2162d5ac4cc3e140488446d
SHA1 b88ccd26410b8c3790d037b41e674e424549dd01
SHA512 f869e3a6c75d5409ed97eea2375f450afc56a9c6c1672df5fb79daa6f2fbeae598e2f4ec52379b7ada26970b1e9104e25988477db561419edc30b243d4ec52bf
SSDEEP 1536:uRjHdFol4/8iW7VRuGZK8Ip6tKVI12/znC6KnNx8ohh6e/o+IZGFPn:ivr/8iW7juMKtHy12/2pnNx8pe/o7Zgf
TLSH
T17C7302B1988B4E7EC62C672D12EE708737A862D5D40192B4D57BC6456F500CFB9CF192
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Vixen.Free.Temp.zip
- Size 72KB
- SHA256 bc26fd5f60834276b009d02a42e14a5ea5a02b059a4606069798751c18b69b43
- MD5 28aa9337c2162d5ac4cc3e140488446d
- SHA1 b88ccd26410b8c3790d037b41e674e424549dd01
- SHA512 f869e3a6c75d5409ed97eea2375f450afc56a9c6c1672df5fb79daa6f2fbeae598e2f4ec52379b7ada26970b1e9104e25988477db561419edc30b243d4ec52bf
- SSDEEP 1536:uRjHdFol4/8iW7VRuGZK8Ip6tKVI12/znC6KnNx8ohh6e/o+IZGFPn:ivr/8iW7juMKtHy12/2pnNx8pe/o7Zgf
- TLSH
  T17C7302B1988B4E7EC62C672D12EE708737A862D5D40192B4D57BC6456F500CFB9CF192
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Items/cat.sys
- Size 13KB
- SHA256 57e7df3f98bcf95885d8b6a1dd007c842f949be018cbf2d807c28df1b0d29a2e
- MD5 18618bad050352ade088baccac516cb6
- SHA1 81715bf5b749748a4a1b030b49d4a01e55ce1ca3
- SHA512 f8d6beb0e8deb0c5d706839d14afdfe35fcb8a3c1d193437af83d68e6b86b889a9548a4b25bd01781c7edf369b842567e2b47a4be621fe963d9fbc8bb795566b
- SSDEEP 192:YOzu830PlOQ7OlpAVtgt2sMmVcgYcHHSCX51cmC3FIhXP:YH0WOwCtdMmVcg5DPC3FIh
- TLSH
  T153521A8B922414EEE36E407AF5209D26E1F2F0850391D6DF5766C63E0B63BE0757B781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  Items/catmapper.exe
- Size 147KB
- SHA256 da3b80cb01f8d568553355d45d11ccf445010c6817becc08d2ef5726609bb07c
- MD5 3c5657b526c9a310e4ed479c3d7b3d41
- SHA1 1704f48aa80ee471a3f58c4aad9a02f34ec3aee7
- SHA512 708e161050030282bd36c5969d693278ce3aaaa17fd76ac511f549a2ac634b26c5b857fcbef855daaeb1dda732bc972605c9d244a94c5eb77ef57bd57bfe0826
- SSDEEP 3072:h72o4BCdZJBuL2+kwjmJTQSaMm5/6NQzl4:h72LBoZJB3TWl6K
- TLSH
  T109E33C5797A51069E2B7DABCDA720902EBB27C454B74D2CF135048B90F62BD0AF3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5
- Target
  RUN ME TO SPOOF.BAT
- Size 1KB
- SHA256 ce93f73768894b952e10de3cd6dc179deb52ea5bb76321f866f2e5e29a04e84e
- MD5 c369105e28e5a7fa94bb5252a728b9a6
- SHA1 a736357e86745fe02623ed464d607a6ad8c04db6
- SHA512 1c028dbebd83efadbe880eaea45771d94faad3dd97604339a28a4d388f8212d086ce9017f27c0d9821c5cadeb5e2861aa1dd955975c8dd87dded98bf4981ae32
- TLSH
  T14B31121A1E8BC66225F0D8A8E3111541F70BE20B691849D0F9A150B46E5A180ABFDAEC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion execution persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
behavioral6 behavioral7