Overview

overview

8

Static

static

1

Xylex-Executor-V2.exe

windows11-21h2-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Xylex-Executor-V2.exe

  • Size

    6.0MB

  • Sample

    240511-hebmxadf55

  • MD5

    203966547f28edf98cac24ee673bf3ac

  • SHA1

    64c5b8d5f0fcb6436cef03945660de933b926320

  • SHA256

    f40e8ae294bc0e35996d211590fb19406c665e786343975e4e64416052c71c0f

  • SHA512

    755e8c13a764c829cdaf7c951428cc5378ceb457546a55f4e70ffbf9da6ea722e215d00aacf103a24be037f0a99a9831f2ad82047036a5a4781fc3535eb488bf

  • SSDEEP

    98304:brPgEtdFBgfS9amaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4R4BMIR36rN:brPHFaReN/FJMIDJf0gsAGK4R4uImN

Score
8/10
executionspywarestealerupx

Malware Config

Targets

    • Target

      Xylex-Executor-V2.exe

    • Size

      6.0MB

    • MD5

      203966547f28edf98cac24ee673bf3ac

    • SHA1

      64c5b8d5f0fcb6436cef03945660de933b926320

    • SHA256

      f40e8ae294bc0e35996d211590fb19406c665e786343975e4e64416052c71c0f

    • SHA512

      755e8c13a764c829cdaf7c951428cc5378ceb457546a55f4e70ffbf9da6ea722e215d00aacf103a24be037f0a99a9831f2ad82047036a5a4781fc3535eb488bf

    • SSDEEP

      98304:brPgEtdFBgfS9amaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4R4BMIR36rN:brPHFaReN/FJMIDJf0gsAGK4R4uImN

    Score
    8/10
    executionspywarestealerupx

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Drops file in Drivers directory

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks