Xeno Perm Spoofer V1.rar
- SHA256 e95c0e97f4d976cdd1158367508376ed9f9207a921de71ac15850257f7502dae
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Xeno Perm Spoofer V1/Xeno Perm V1/AMIDEWINx64.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
30 seconds
Behavioral task
behavioral2
Sample
Xeno Perm Spoofer V1/Xeno Perm V1/Perm Woof.bat
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
30 seconds
Behavioral task
behavioral3
Sample
Xeno Perm Spoofer V1/Xeno Perm V1/amigendrv64.sys
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
30 seconds
General
- Target Xeno Perm Spoofer V1.rar
- Size 121KB
- Sample260731-vggyxsysd1
- SHA256 e95c0e97f4d976cdd1158367508376ed9f9207a921de71ac15850257f7502dae
- MD5 f29aaee9b8879c2ca68663dc698ddad1
- SHA1 82d0f542403cd01b76b7d92554a88c99f2898d10
- SHA512 354a199ed675a158ece6086c3b32b75175704d856a24ceeaf13914d20d4faf8ea77a659638eeca69388a05176dff5cb5dbf165f1d4d940c3aaf8344e7dd15f94
- SSDEEP 3072:WlQcx6vN7Lb8+ujh/Pove8C3KmMzd9LUcqELCh6aKKA7:Wicx6F7vfmNJHcz7LULEOoaK
- TLSH T115C3123D0D9F235B4DF674C10DB38B4934D2EA43AB2491165A6171689DE5382FC88FF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Xeno Perm Spoofer V1/Xeno Perm V1/AMIDEWINx64.EXE
File Explorer
-
Xeno Perm Spoofer V1.rar.rar 121KB
-
Xeno Perm Spoofer V1/Xeno Perm V1/AMIDEWINx64.EXE.exe 377KB
-
Xeno Perm Spoofer V1/Xeno Perm V1/HOW TO SPOOF.txt48B
-
Xeno Perm Spoofer V1/Xeno Perm V1/Perm Woof.bat1KB
-
Xeno Perm Spoofer V1/Xeno Perm V1/REQUIREMENTS!.txt304B
-
Xeno Perm Spoofer V1/Xeno Perm V1/amigendrv64.sys.sys 35KB
Xeno Perm Spoofer V1/Xeno Perm V1/AMIDEWINx64.EXE
- IMPHASH e3d5de629e09ae6898196a1418661d7f
- SHA256 18969e7f7f75cddaad96d5ca2cc45110afc42ad2ad8e0e17a2e3e4afca312f06
- MD5 97bea101348479d29c609ddd82ca8926
- SHA1 d814c5dc3e1b58e75d1ae25dcaa77dd1db14c7a1
- SHA512 d1e4f95093f5afd1beb4ee2e4279fdb5929de928443e4888c0680b7d7eb74d4c3beaef9356859733790d9ce64647db9466535617dd9da8186d96b05472a6df94
- SSDEEP 6144:8YF3mEzg2Dm/BPZw5/C3PCrhbb2kfsGPJ0NAOOAsVLBfnsWr9/ZRIcY:P1gom/Bxw5/C3PCrhbb2kfsGPJ0y5BfX
- TLSH T13F84F52AEB9620F4EC7791BC84922306FBE075684731D7D777AD460A1F33AE4A939710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
4652
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetFileType
GetStartupInfoW
DeleteCriticalSection
EncodePointer
DecodePointer
FlsFree
SetLastError
FlsSetValue
FlsGetValue
GetLastError
GetCurrentThreadId
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
SetConsoleCtrlHandler
FreeLibrary
SetHandleCount
LoadLibraryExW
HeapFree
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
Sleep
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapReAlloc
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleW
GetProcAddress
SetUnhandledExceptionFilter
GetVersionExW
InitializeCriticalSectionAndSpinCount
GetCommandLineA
SetEndOfFile
SetStdHandle
GetSystemFirmwareTable
GetVersionExA
SetThreadExecutionState
CreateMutexA
SetProcessAffinityMask
GetCurrentDirectoryA
GetModuleHandleA
DeleteFileA
GetWindowsDirectoryA
LoadLibraryA
GetSystemDirectoryA
CloseHandle
GetFullPathNameA
CreateNamedPipeA
CreateFileA
ReadFile
CreateThread
LocalFree
DeviceIoControl
LocalSize
LocalAlloc
lstrlenA
FormatMessageA
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
HeapSize
GetConsoleCP
FlushFileBuffers
CreateFileW
WriteConsoleW
SetFilePointer
GetProcessHeap
advapi32
StartServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatusEx
ControlService
DeleteService
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
CreateServiceA
shell32
ShellExecuteA
user32
ExitWindowsEx
RegisterClassExA
DefWindowProcA
DispatchMessageA
BlockInput
GetMessageA
MessageBoxA
CreateWindowExA
SystemParametersInfoA
TranslateMessage
Name
.text
Size
212KB
Virtual Size
211KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
81KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=11, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=117, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=77, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=136, version=30729,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=135, id=1, productName=Unmarked objects,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Xeno Perm Spoofer V1/Xeno Perm V1/HOW TO SPOOF.txt
- SHA256 e852d0c6cacd1858f034254c3a3634f0667a457fd82d5b08534d58c25e8a9fa1
- MD5 ab163e27c6f9f5420429a457b13f8864
- SHA1 faaafd75f0d0dbecf8cdbe3af5067ee7df514854
- SHA512 92a5855dc16aa868809c38b58e9bfb54c69d272e9c15ac6f431621c011d9835aa3e2a36154fd8638f75ddbbb98d3a523160a2e12f7eed4d48f6ae5ebd61ad8bc
- MD5 SHA1 SHA512
Xeno Perm Spoofer V1/Xeno Perm V1/Perm Woof.bat
- SHA256 78621369c86caebe7e1101631ec9a7d5c745941d76606e220b8daeb2df2b6a8a
- MD5 9ba727742f656b90aa1b329536778038
- SHA1 e744932825b087ebee102b7c00b76cd03fb3f665
- SHA512 18714800c1e61648184999ce12028d021821e1b10eaa30e912bed3794c39b947bbf581e8a4eb96324215b2617fb0770123014c43b145b997729767f2632db544
- TLSH T11B311B78D8ECD480CCF09DAB249368E4A89FFD9F5D1E5BF6FC9B1354060092A1256BC9
- MD5 SHA1 SHA512 TLSH
Xeno Perm Spoofer V1/Xeno Perm V1/REQUIREMENTS!.txt
- SHA256 87557c67b17d808ea0ae702780c73175e747893357e66e355d02cae9dd13f5ee
- MD5 5d6528b1148d654604dbf177883067a6
- SHA1 00e3323072c90c1216a22119ba5adfa8c56f574f
- SHA512 1662f399290ed78cc2846e5c8bc8c1249d20bc5484d2f7c669ad2d3f44729d5ebbb939e9051bfbd0276e430cc00f2cf558ef67750a964d3fff619ad9145ffa68
- TLSH T1D8E0260A9180F0244C3940B7472BA347DE181030363195201834B03D17961A7F233AE2
- MD5 SHA1 SHA512 TLSH
Xeno Perm Spoofer V1/Xeno Perm V1/amigendrv64.sys
- IMPHASH 35ce4f00ca063f6bffa0759d88c3a148
- SHA256 b9e8de155fb9aabb4760034a65855130eb85aadc88963e40e2be87b049c025bf
- MD5 8d533ae1500f743a177b27c88a241163
- SHA1 52c25cf4c903714fa52870a16d143fb6aeb0fa99
- SHA512 546c9309b9b078ce4c49a3b56ec8d77b0fd4c0bd583f4bce53705f854fe2addba5c8029ed8b8da9e944b2c212d2ee0508095bf20c12632b760a5c271d19940de
- SSDEEP 384:mrzqfCQlZluZfnktrQsHGh1jEiI4IHith5kCN88ZGmGovy8ZpHcS8FRJvIsWAR9k:+dCluVG0zuiv1yiR89PL9zIf
- TLSH T17BF28ED267786081F99B993083E9D633BDB4B2852B1093DB12B1D0552EE3BD5773422F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
69:ec:ee:5d:c6:96:72:bc:b8:ad:ce:12:99:01:f1:3a:fd:c4:21:b7:e9:99:89:91:3b:f4:8a:57:a7:bf:15:3c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 10, 2023
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
69:ec:ee:5d:c6:96:72:bc:b8:ad:ce:12:99:01:f1:3a:fd:c4:21:b7:e9:99:89:91:3b:f4:8a:57:a7:bf:15:3c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=7155083,CN=AMI US HOLDINGS INC,O=AMI US HOLDINGS INC,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Apr 7, 2023
SERIALNUMBER=7155083,CN=AMI US HOLDINGS INC,O=AMI US HOLDINGS INC,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
SERIALNUMBER=7155083,CN=AMI US HOLDINGS INC,O=AMI US HOLDINGS INC,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
b9:96:37:58:ea:d2:36:c6:e1:5c:d4:8b:a5:43:3a:ae
Issuer
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 21, 2020 - Sep 21, 2023
Subject
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 3, 2014 - Dec 2, 2029
Subject
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
61:18:54:86:00:00:00:00:00:24
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 11, 2011 - Apr 11, 2021
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:f3:15:8e:a5:7d:1c:55:9f:29:00:00:00:00:00:f3
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 12, 2023 - Dec 15, 2023
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:8D41-4BF7-B3B7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b3:fe:25:ce:29:1b:1b:8a:1c:00:01:00:00:01:b3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
32768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\AMI_Code\Flash\00_AFUDriver\AFUDriverSourceCode_Build\AFUDriverSourceCode_5.6_20230321\AmiFlashDriverSrc\sys\x64\Release\amigendrv64.pdb
ntoskrnl.exe
ZwUnmapViewOfSection
RtlInitUnicodeString
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
KeLowerIrql
KfRaiseIrql
MmMapIoSpace
MmUnmapIoSpace
RtlCompareMemory
ZwClose
ZwOpenSection
ZwMapViewOfSection
ExFreePoolWithTag
MmGetSystemRoutineAddress
PsGetVersion
ExAllocatePoolWithQuotaTag
ZwQuerySystemInformation
ObReferenceObjectByHandle
RtlGetVersion
hal
HalTranslateBusAddress
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
444B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
512B
Virtual Size
328B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
850B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=1, productName=Unmarked objects,
count=5, id=257, version=24610,
count=5, id=259, version=24610,
count=4, id=262, version=24610,
count=4, id=260, version=24610,
count=2, id=259, productName=VS2015 UPD3 build 24210, version=24210,
count=9, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,