Overview
overview
10Static
static
3AMIDEWINx64.exe
windows10-2004-x64
1AMIDEWINx64.exe
windows11-ltsc_2024-x64
1Run.bat
windows10-2004-x64
10Run.bat
windows11-ltsc_2024-x64
10amifldrv64.sys
windows10-2004-x64
3amifldrv64.sys
windows11-ltsc_2024-x64
3amigendrv64.sys
windows10-2004-x64
3sn.bat
windows10-2004-x64
10sn.bat
windows11-ltsc_2024-x64
10General
- Target 7690fb2f0595252e706f1e8c12c2e6453fbbd92d3ec2d53ea7ab472b05c76885
- Size 159KB
- Sample261029-mk17zaa18w
- SHA256 7690fb2f0595252e706f1e8c12c2e6453fbbd92d3ec2d53ea7ab472b05c76885
- MD5 99246524a52ab63720b4b7b1e351116d
- SHA1 034e2c175494472cd78372f82e9a962f853edb73
- SHA512 52af719412b70312f6e06f09232b3a7cecfeaa9e5b6d52e5401cfe49eb9fec7e99aaff18812eef1b7ce0124309a1693b741880c54f7caf0ff74f8ec5c906fe8a
- SSDEEP 3072:Mj2Yvu4Gway6TohaeFQgBvve73LBDxY7Mumd8THsA2PHiXyskk2CI:Mj2YvSwVaeF2pDiqGHslPHiXOk4
- TLSH T1D9F3121D5B5C03CBCECAE2F8A5168CC5642C3CC6B45B2358A6827195DA3B5EF8F476C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
AMIDEWINx64.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
AMIDEWINx64.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
Run.bat
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
Run.bat
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
amifldrv64.sys
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
amifldrv64.sys
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
amigendrv64.sys
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
sn.bat
Resource
win10v2004-20260911-en
Behavioral task
behavioral9
Sample
sn.bat
Resource
win11ltsc2024-20260911-en
Malware Config
Targets
-
- Target AMIDEWINx64.EXE
- Size 377KB
- SHA256 2c67fb6eb81630c917f08295e4ff3b5f777cb41b26f7b09dc36d79f089e61bc4
- MD5 64ae4aa4904d3b259dda8cc53769064f
- SHA1 24be8fb54afd8182652819b9a307b6f66f3fc58d
- SHA512 6c16d2bc23c20a7456b4db7136e1bb5fcee9cbf83a73d8de507b7b3ffc618f81f020cde638d2cd1ef5f154541b745a2a0e27b4c654683a21571183f7a1bffd16
- SSDEEP 6144:4NFU+vVycygjjsp5dcAONdA22xVK8LRPo4WBIeX+oD9/nwbr9W9v6i:4bygjjsrdcAONdA22xVK8LRPo4WGkD90
- TLSH T1ED84296AEBA620E4EC7791BC84912302F7A1B4644731D7E7B3AD451A4F33BE4A93D710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target Run.bat
- Size 216B
- SHA256 5a8585c1e5bf7d02be3590c94f7bf25804f9f9af3ee74e626c5d2b42b28650de
- MD5 2ff229035f388999fed9f49e4025f877
- SHA1 ff655c2033b80c5aa63875ee75e1e63b95df2a45
- SHA512 932c149c9f875792b06a0f65a908ccea3f35b5184030331125fcdfdeb005d70bc568434e2af05224eca95ee278b188e61ca562017d561ec0950b6ff1dc766037
- TLSH T146D022373DC2119969860A71DAF1BCC5B3D66AD3000BFBE8A710E1F0E869C950650EAC
- MD5 SHA1 SHA512 TLSH
Score10/10-
Family: Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
- Target amifldrv64.sys
- Size 28KB
- SHA256 20f11a64bc4548f4edb47e3d3418da0f6d54a83158224b71662a6292bf45b5fb
- MD5 0dff47f3b14fb1c1bad47cc517f0581a
- SHA1 db3538f324f9e52defaba7be1ab991008e43d012
- SHA512 f572e741b5a7e854353420bfe072f4e8d10ea61bd0be06a48f3b07bb58e98987761a4cbd77423bf1ab4a9a79b599b824b6b2951bae9e8ad16bca98c84c72b0a6
- SSDEEP 384:Hv+RD9ZsRVl8jqiZchbao0HMrEDulUoLdZFnJtQSZsHLPK6jzOO9bvFR3lZbI1:HvyJZmmqlHCMmulJLZJt6PKgaO9Po1
- TLSH T1C6D24B91C6784C43EEA3DD3062F4D6277D34B6822B60CACF411AD0A44B927C1AB7C36D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target amigendrv64.sys
- Size 33KB
- SHA256 38d87b51f4b69ba2dae1477684a1415f1a3b578eee5e1126673b1beaefee9a20
- MD5 119f0656ab4bb872f79ee5d421e2b9f9
- SHA1 e35969966769e7760094cbcffb294d0d04a09db6
- SHA512 428c2a7db1559cb39a882a7dce5a0559efd9d83c2e86ca94bbe3c10c9989fe63c160ab7f475db0400a2ed016ab21f00faa9d0e0b7fdba5e3c34daadab24e71f2
- SSDEEP 768:Jn9+pli0X09luuJ4j/2HGra+Jt6PKgeGPeHPc:t0muuJK1a+JtkwGPMc
- TLSH T1F8F25C9197B84C92FDAB9E3062E0D6577D78F6D23A30C7CF0164C0640F63BC26928369
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target sn.bat
- Size 1KB
- SHA256 cf982fd519273de4e1ec7c0c43c119dfb10df2b31691b6178f6de0ff9b483a93
- MD5 710c62d79d05aa77b09609cd9dfbfc5b
- SHA1 f7693959741ee80a0066832293a6567fa791f607
- SHA512 4088b7dc5bbd87ba9b6873f215d8aa5b366c5ff0de661e2e14421751a94cf4e952030402d00ae40f4bd22681bc31e39a2ef05cee2a0f60528242ef2b6a00ca58
- TLSH T10F21DD09A140DD6E5D7FC053FB012D7CE069A14784DA75B6A78E74010E30EFE8E0ABE1
- MD5 SHA1 SHA512 TLSH
Score10/10-
Family: Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.