Overview

overview

10

Static

static

10

XENI_LOGGER.exe

windows10-2004-x64

7

Creal.pyc

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XENI_LOGGER.exe

  • Size

    13.9MB

  • Sample

    231009-rvdlwadd7w

  • MD5

    46c750994cbd950b5d52d7f1a96e9eeb

  • SHA1

    9303ce2ac1f3197825732315bdec54ad9cfa698a

  • SHA256

    d11853e3cf26ecf5e4832fe02d554409941704fcd2167f30435ce2a392d1a977

  • SHA512

    3d6d21473ebb761c3a8ec7cfd30ade6d90dfb653bf05e1e8160e06459b49189c522be1f5cb6c5632b969c96f17205bfa4643f5e6f099f50d5d11db521841e748

  • SSDEEP

    393216:du7L/VdQusl7Q+q9RoWOv+9fai6nO6ql:dCL9dQu2QdborvSii6Z

Score
10/10
crealstealerpyinstallerspywarestealer

Malware Config

Targets

    • Target

      XENI_LOGGER.exe

    • Size

      13.9MB

    • MD5

      46c750994cbd950b5d52d7f1a96e9eeb

    • SHA1

      9303ce2ac1f3197825732315bdec54ad9cfa698a

    • SHA256

      d11853e3cf26ecf5e4832fe02d554409941704fcd2167f30435ce2a392d1a977

    • SHA512

      3d6d21473ebb761c3a8ec7cfd30ade6d90dfb653bf05e1e8160e06459b49189c522be1f5cb6c5632b969c96f17205bfa4643f5e6f099f50d5d11db521841e748

    • SSDEEP

      393216:du7L/VdQusl7Q+q9RoWOv+9fai6nO6ql:dCL9dQu2QdborvSii6Z

    Score
    7/10
    spywarestealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

    • Target

      Creal.pyc

    • Size

      128KB

    • MD5

      b975959ad3fa641900f85730108c8ee8

    • SHA1

      8488731303e8fac8de90e00393dd842d1aa40238

    • SHA256

      528f23dcc72c3570e335c3aa548b07cbedeb4d905822c45c4d64f74a76febfbc

    • SHA512

      f91eccc54f002b02b128abdc9145e2f6f66fdfbfdbd49ce27cb3ff52ee759ca1c74ef87e09b1f65bdad766c8ab3cb82f6f84806ef6c8adcf16571078c2cd7927

    • SSDEEP

      1536:LuPDrme3uzTZMB7aK1I3aqqj3CqHzdaYzT2zc9XqTmOwvnBYKjuGCjyqS:yPDqe3uz0BWKqBqVzCOOwv+/c

    Score
    10/10
    crealstealerstealer

    • An infostealer written in Python and packaged with PyInstaller.

    • crealstealer

      An infostealer written in Python and packaged with PyInstaller.

      stealercrealstealer
    behavioral2

MITRE ATT&CK Enterprise v15

Tasks