General
-
Target
Xylex_Executor.exe
-
Size
17.0MB
-
Sample
240531-t25p2seg86
-
MD5
c603fe7627aea197d40071d4b108d7ab
-
SHA1
f92863306d69d5eed65f1cbbf0dc9dbe2e3bdbc9
-
SHA256
995974b2833aea2494086e73394ff8f68d9caf17a15cb19ab3b44cf56c30d324
-
SHA512
7403ff5c53a64fe05bbd1c1e6051d12a6fd73f050cf18056aa5215851f55ab05d1e475d775c784828c7f35ba80be455a3978bf99815fc881cdfc0d06fd153f65
-
SSDEEP
393216:aE6QdqiXJWQsUcR4NzBdQJlewF3MnG3xl5gu3jBsn9e8WdaMU0i5VjwIH:aE6qXXYQF5dQT3MGxguVGjBCWjF
Malware Config
Targets
-
-
Target
Xylex_Executor.exe
-
Size
17.0MB
-
MD5
c603fe7627aea197d40071d4b108d7ab
-
SHA1
f92863306d69d5eed65f1cbbf0dc9dbe2e3bdbc9
-
SHA256
995974b2833aea2494086e73394ff8f68d9caf17a15cb19ab3b44cf56c30d324
-
SHA512
7403ff5c53a64fe05bbd1c1e6051d12a6fd73f050cf18056aa5215851f55ab05d1e475d775c784828c7f35ba80be455a3978bf99815fc881cdfc0d06fd153f65
-
SSDEEP
393216:aE6QdqiXJWQsUcR4NzBdQJlewF3MnG3xl5gu3jBsn9e8WdaMU0i5VjwIH:aE6qXXYQF5dQT3MGxguVGjBCWjF
Score8/10-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Registers COM server for autorun
-
Adds Run key to start application
-
Blocklisted process makes network request
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-