6797c4ddcc7917ea9e6f28e61a96795d5ae1fa8e29440b71cdacee2787d2fd61

Sharing

Copy URL Twitter E-mail

General

Target
VixenFreePerm.zip
Size 2.3MB
Sample261027-bcllrszzby
SHA256 6797c4ddcc7917ea9e6f28e61a96795d5ae1fa8e29440b71cdacee2787d2fd61
MD5 936ccc789f49d56a6ac328f10d4aca22
SHA1 b53b4a9a0594847f5567540378d6c6dbd3ad81ae
SHA512 297e1281502c1f321809caf21e3734f56648ff770f808bc57503ecca4e94f55a713e789d148b70803b0f0f960d0cc9e6d694587aabb0ac5a26424bb131d4cc40
SSDEEP 49152:r85miX5N4clVYBEWu2DmKCPbCO4GMUkD1eexrSd/3aaObd0+YeW+2PR13:riX0clXWTDmKCOOXMUkDtO/3msel2Pf3
TLSH
T12CB53353F0F863AC91B58CAF97771CE68583ED50AD0CFE0989941E6621C1C866736FAC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  VixenFreePerm.zip
- Size 2.3MB
- SHA256 6797c4ddcc7917ea9e6f28e61a96795d5ae1fa8e29440b71cdacee2787d2fd61
- MD5 936ccc789f49d56a6ac328f10d4aca22
- SHA1 b53b4a9a0594847f5567540378d6c6dbd3ad81ae
- SHA512 297e1281502c1f321809caf21e3734f56648ff770f808bc57503ecca4e94f55a713e789d148b70803b0f0f960d0cc9e6d694587aabb0ac5a26424bb131d4cc40
- SSDEEP 49152:r85miX5N4clVYBEWu2DmKCPbCO4GMUkD1eexrSd/3aaObd0+YeW+2PR13:riX0clXWTDmKCOOXMUkDtO/3msel2Pf3
- TLSH
  T12CB53353F0F863AC91B58CAF97771CE68583ED50AD0CFE0989941E6621C1C866736FAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  RUN AS ADMIN TO SPOOF.bat
- Size 318B
- SHA256 dff0fdf728408791b0fd6505e800a7ab75101d973c921c77ea334ec63fdc36aa
- MD5 60972c42004f8c1fb66bfdc828d061cd
- SHA1 4bb0dfc693820dc04da065ceb00aab1cdc82dcea
- SHA512 0715ccf5eb85ddbdeb8e63357b32d38808f7f09046d8fa71d1392a6fb8c27a30fd016824e89afa5fb882bed42220dcc32b891a89adbd967d084d55a7e3cede06
- TLSH
  T162E02601308A72114CB0489A1FB9A8AEDF4F826B4127AD14747B80395E6924CA1E80C9
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion discovery execution
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  deps/AMIDEWINx64.EXE
- Size 377KB
- SHA256 47c16703fa7df006f9559fca8b1482b4c59111017a0530c1edac3caf0bdaaf39
- MD5 6dea36ae7a414e376b00829e16da52e0
- SHA1 5ddb6b72867002a03f26aed612f320e82598464e
- SHA512 f61f6a661e816ff72a91849c8363dbbbadadc24d34c25072a3cbb3be16ce9a540c8f86ae2c031fc97e5484944d8957cd7a7e3104dee2a2091b2b344422e30487
- SSDEEP 6144:u0lLNvLmP/LgoYG5HViOlHH7qKPUcky2FpwhPa24UW3Plqr9hUURgr:lzmP/Lgk5HViOlHH7qKPfky2FpwhyV3X
- TLSH
  T10084F66AEB9220F0EC77917C88922306FBA075684771D7E7B7AD450A4F337E4A939710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  deps/AMIFLDRV64.SYS
- Size 29KB
- SHA256 65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9
- MD5 f22740ba54a400fd2be7690bb204aa08
- SHA1 5812387783d61c6ab5702213bb968590a18065e3
- SHA512 ac1f89736cf348f634b526569b5783118a1a35324f9ce2f2804001e5a04751f8cc21d09bfa1c4803cd14a64152beba868f5ecf119f10fa3ccbe680d2fb481500
- SSDEEP 384:qvOTI5HIPy54ygZOq0HMMKf69JG8QnuOfZFnJtQSZsHLPK6jjMYiWPFRUI5xl9Wn:qvsUoK54ZCMMb9U82uO7Jt6PKg4YHUc+
- TLSH
  T1EFD23B92C6B45C87EEA3993162F4D263BD35B69237608ADF4026C0950F93BD1A73C369
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  deps/EEUPDATE.exe
- Size 4.5MB
- SHA256 bc195aac847d8015d875562be929804e59bf0c0cdab5407a06f3359be98641a2
- MD5 4325420a99393a6ad6044818ae61f945
- SHA1 cbe636eee83e6a016d0ed65a09dc88a5cb8398a3
- SHA512 30a7456f6c55d957a9bdf9ca1f9c2fb76f6144015f24ccfcb5168275996091c425dd86e08b6d0b4940ff63af6876b1393aa8926bef62a880a5ff1b9551f5a0ae
- SSDEEP 49152:xVBQSmh7Dtk/bX5YuWI4zAXFBVTf9UnoGvlG0unS9w:9yD+/VYzI4zA1BRf9FGvlG0unS9w
- TLSH
  T1C626F957E7B321F5D4BAD1345143733ABC7274698338DBD79A808A1A4732BE0A93EB44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  deps/PSWOA.exe
- Size 392KB
- SHA256 3f93b27c72838fd452d71706296a6273e84f3dec953cccda2666333d6e5be222
- MD5 77a82dfb2ad17a03c1057f9d76bebe80
- SHA1 43f4dbdf7996419086f74b644ec8ecea64b33249
- SHA512 9cd7b66f6203811c0cb3488667248943eee564d95bbb70f9815fd049970fcc92f67d0734a25829cc058f34aa9b1217f79088a4cb6f4ea74d9c3fde9b014c909f
- SSDEEP 6144:J32tDyw4/cNP4vTTkHcnL1cUInSRUWv7qlm5beS:Jm33snkZUISQQaS
- TLSH
  T1AC847C19EA9109F9D9A79578C9224546E731BC4F43B0D6DB23FC0A560F17AF06E3AF02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral11 behavioral12
- Target
  deps/RTIoLib64.dll
- Size 155KB
- SHA256 e68365ab48c6fa3b3c8036c578cd61793e645b76c8a17641ff07ad01038ccbb8
- MD5 23b63b64c57ffe0129af6ee4b38ea7db
- SHA1 ce0cec8e15d7d9cc861613a6b2599cf2d580c70f
- SHA512 3a5b19c4363e4bafd6a6ddc538ac592afebd81b6de05687e7f169c402c232ca9685ac36391c03719e588b919cdb0fadd56b42d26ae90b1e3aa3e231e0686e4ab
- SSDEEP 3072:RMmIcRC1BP5gn6ENjoJszSKKmNdWTZILJpu9S5:OURC1yvm2f9dWYpJ
- TLSH
  T110F34A91B19200F4DAFA993489E54A06F7F178244325A7CF266082270F73BE9FD7E395
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  deps/RTNicPgW64.exe
- Size 745KB
- SHA256 791d18024007d988725ad24ae499f9e8f26dfc1ac8f95f9094568fc5c300d0bf
- MD5 302a86510b5c2a807bfad326224880d1
- SHA1 0afea09cb54d9216895e1ad2e60e2606c89d8697
- SHA512 a4da927d4e33639b97062fcae6003075e60ce939edf7e807119e2f5b300c0918fdbd801668d78e8a707e920bb7b4aade72ed4ac3f3168129b1af2fe40397ff4f
- SSDEEP 12288:pp99WL/vCzx3QRIL4DbKsxA/3SYsF2WKEnkiUJ0yn:r8/vaN4PKsxisF2L+yn
- TLSH
  T11CF4B05E56B106B5D1A68230C596461BFAF530100328EAFF66FC4AB15F77B862E2FF01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  deps/amigendrv64.sys
- Size 36KB
- SHA256 811e5d65df60dfb8c6e1713da708be16d9a13ef8dfcd1022d8d1dda52ed057b2
- MD5 9accebd928a8926fecf317f53cd1c44e
- SHA1 d7d71135cc3cf7320f8e63cefb6298dd44e5b1d4
- SHA512 2563402cc8e1402d9ac3a76a72b7dab0baa4ecd03629cc350e7199c7e1e1da4000e665bd02ac3a75fd9883fa678b924c8b73d88d8c50bf9d2ae59254a057911e
- SSDEEP 768:cBOmh786zi+NqkO8Ouwn3uivOyiRZSFInq1os29zjTUD:cXi+NXwnecOyiaFInq1lCz+
- TLSH
  T1F6F27CC25B7824C6ED97993082E8D673BC71F6A61B1083EB01B0D0251E93FD16B3922F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17
- Target
  deps/i3782.bat
- Size 5KB
- SHA256 5d1c7fc83a9b03ec15af37328df37e71e222d0433dc513e01b6ca0e161457e07
- MD5 b3c2e53412fa8d74dd0a9ec7811f16b9
- SHA1 3d1f49a3fabd821967a943d353444bb3d08f08f5
- SHA512 a55ddec20d0658e260190b236cf0692501b94ce2ca0e32130f5a613bdad2fd9171574df8e875df0ea61709864ae062f57960676f8e0f278da2e79b65e1097498
- SSDEEP 96:3UmsVWzs0hTky9a/Pijqp+akPijQBMMwVgsFgH4VfFtK6zoyN7t:EphyOYtfsFga06zRN7t
- TLSH
  T14BC143BC6ED0A231DE9AC716AE2650C2F366D1B60126558C30DB90A8F60747C737EAF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Drops file in Drivers directory
- Drops file in System32 directory
behavioral18 behavioral19
- Target
  deps/iqvsw64e.cat
- Size 9KB
- SHA256 bd4f42c45db35f9b042d610fab4c9810132dffea07265422f360b342b4a7790e
- MD5 93e365f71c2e9c8d61c64f2783fa0868
- SHA1 b3662eecbeafe5af9ee3be504df77cbd99fc7c36
- SHA512 031e615503633fc643dd72f44eeee7961361945a5ba4e6d2dc0ff184b38f7e2b65a5e9ab53315b40e895a9d7fbce9a91f180bac6738ee681744f6301ab0c5838
- SSDEEP 192:Qt83i2oJCuvyyKwnsFWQF7aCOJxZAqnajKsQcLIm:cdrnsFR5aCOJ/AlGsQcsm
- TLSH
  T1DC22D7E24A6C54C3ED53286043A8E567BC3D6BCB2C50856D31AFE7A51C83BC5E70856D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral20 behavioral21
- Target
  deps/iqvsw64e.inf
- Size 2KB
- SHA256 4af639c5c9f9106f73985a8c53a916d73c78a3bf67b450eaf4b06387129c3975
- MD5 9fc2029a6ebf64e1af9f656b82fdea1a
- SHA1 20c6e51b5dacde55d80b0873720f987d2593c47a
- SHA512 1ccbb5c488e7967baadca45d241f5d66ea1559d886662bc25c86b91634a7639416d5a8777f1e07a1b7d3cc638b857d32a52ef2960e935cb03c682abe4827dd02
- TLSH
  T1D141CCAD19E34E49767B34A193A3CAC2F210200609443D8D345EF4A5AB3ED9DD3659BE
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral22 behavioral23
- Target
  deps/iqvsw64e.sys
- Size 61KB
- SHA256 a1c886d0e3b8dae271940d6c366f10fa54aff9582ee571394d7b0ead60f9c609
- MD5 a04fa610c631055c3c7b11df5887fbab
- SHA1 b37916fb4a764aa82cff5faba997437d3d93fb30
- SHA512 4fecdb2de280cd251421e3f09188b62fa95732db19488846677e75277f0a271d06f5ae2d38b62b65b359c03d715ece14cc5ff11aab0f7c4520bdd10904740f92
- SSDEEP 1536:LfeG1kQWHBqSfyAXy5IFCxxoPt1Q+8iAS2w2zB:LfwFftuQCr5D3t
- TLSH
  T1255349C72BB420C4F8FB9575869AC66BEFB0B19A17324BEB06A5C0550E533D1873D683
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24
- Target
  deps/rtkio64.sys
- Size 53KB
- SHA256 4ed2d2c1b00e87b926fb58b4ea43d2db35e5912975f4400aa7bd9f8c239d08b7
- MD5 96e10a2904fff9491762a4fb549ad580
- SHA1 02a8b74899591da7b7f49c0450328d39b939d7e4
- SHA512 06f477ddbcac1b1e79f142b4c0476e5c27b2a002b8d84ca098fc2d66df9b6f4ce6fe2e4c1648b061f594ad7c410e6daa37526a84d4f5b379699e8c8a89147ee9
- SSDEEP 1536:raz9Zl4jhovMHMvi78HOXtcrEC4RsbuaUfc:wDk+MsviouRC4a
- TLSH
  T196336C51C3A40865E9F7CE78B8F8922AFEB1B445A734C6DF0218C1919B53BD1AA3C356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  deps/rtkiow10x64.sys
- Size 63KB
- SHA256 ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89
- MD5 96a8b535b5e14b582ca5679a3e2a5946
- SHA1 f6b3577ea4b1a5641ae3421151a26268434c3db8
- SHA512 ca8ec4cec41e47560cc4d3b3af7bffa5c27455a1f55cc6ca1f3b1553ceda93b501a62a3f3599db1c88fd20fdeb48630973255ca23129b7036e938c7faaaf0376
- SSDEEP 1536:+OsdGoYvrhm0Kxu4RN496QOxsbXgkUfQOLf:Rm0K321OcoLf
- TLSH
  T1BB536D9197E80891F9B7CE7165F89057BE71B6862B31C6EF0229C0649BA3BD0F734319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Tasks

Sharing

General

Malware Config

Targets

Stops running service(s)

Drops file in System32 directory

Stops running service(s)

Drops file in System32 directory

Drops file in Drivers directory

Drops file in System32 directory

Badlisted process makes network request

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27