93f72cde97bcbd9798e4ad571b8ae297deb741cf814e175418db4c285b9a6ec6

General

Target
zzz.zip
Size 72KB
Sample260807-eed69axamh
SHA256 93f72cde97bcbd9798e4ad571b8ae297deb741cf814e175418db4c285b9a6ec6
MD5 c4c076eec606d1ca6e449ee0e957a2c7
SHA1 a541d6159b8dc079769db2b373546d33e5fde1ff
SHA512 f12457d3e16e1540864d7886a339b36486b1bf0eafe11e4d390e7019214c92edaf4a489ef90a2981ffe86f41be4ab1c78ff5b4821a4a31d2325ca08d1d7cbe03
SSDEEP 1536:840GDrAGOCagtRKG44CrR8Xj7miZSTx/4b6Dztb6iK2+:8ArAGlUKX3miaxwuPxc7
TLSH
T1E973020B91CC6223D38A6C7C8DC6678C91D45FBAF93C14125225FEA62C51FCFCCA2999
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Vixen.Free.Temp/Items/cat.sys
- Size 13KB
- SHA256 57e7df3f98bcf95885d8b6a1dd007c842f949be018cbf2d807c28df1b0d29a2e
- MD5 18618bad050352ade088baccac516cb6
- SHA1 81715bf5b749748a4a1b030b49d4a01e55ce1ca3
- SHA512 f8d6beb0e8deb0c5d706839d14afdfe35fcb8a3c1d193437af83d68e6b86b889a9548a4b25bd01781c7edf369b842567e2b47a4be621fe963d9fbc8bb795566b
- SSDEEP 192:YOzu830PlOQ7OlpAVtgt2sMmVcgYcHHSCX51cmC3FIhXP:YH0WOwCtdMmVcg5DPC3FIh
- TLSH
  T153521A8B922414EEE36E407AF5209D26E1F2F0850391D6DF5766C63E0B63BE0757B781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1
- Target
  Vixen.Free.Temp/Items/catmapper.exe
- Size 147KB
- SHA256 da3b80cb01f8d568553355d45d11ccf445010c6817becc08d2ef5726609bb07c
- MD5 3c5657b526c9a310e4ed479c3d7b3d41
- SHA1 1704f48aa80ee471a3f58c4aad9a02f34ec3aee7
- SHA512 708e161050030282bd36c5969d693278ce3aaaa17fd76ac511f549a2ac634b26c5b857fcbef855daaeb1dda732bc972605c9d244a94c5eb77ef57bd57bfe0826
- SSDEEP 3072:h72o4BCdZJBuL2+kwjmJTQSaMm5/6NQzl4:h72LBoZJB3TWl6K
- TLSH
  T109E33C5797A51069E2B7DABCDA720902EBB27C454B74D2CF135048B90F62BD0AF3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Vixen.Free.Temp/RUN ME TO SPOOF.BAT
- Size 2KB
- SHA256 f22e326d65a5c17a82f4c5c1c111c4ff45ca2d934bf597a0ce845b1d6205a8eb
- MD5 95908ce654e3daf354ea45d6970cfbab
- SHA1 8e3ff5e100f4472fbe3d8d2a6edc0e248d98d5a9
- SHA512 61268dcac4a1c0249109436d2c88de918415862cd5c0d0693fc9c408e990bb57fb49f179b4164524f3d5b9445cf09dc228507eaa0c605b5910b22ca6016b6a9c
- TLSH
  T16051530A2D8B87B152F0D4E946646056F60AF30F191C1E94B0DE60E45F353C16BFEAEC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion execution persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
behavioral3