xenorat | SynapseX[.]revamaped[.]V1[.]3[.]rar

General

Target
SynapseX.revamaped.V1.3.rar
Size 659KB
Sample240704-vze72ssdjf
SHA256 13f63c65ac270ce6d8f462791b1bb0ca64b8f7000f230b1c2ade64db617c5eac
MD5 25e767f22f576a1187ca297428a909b3
SHA1 a6ad4d278d09e0ecab07d095e996c91e9afb3b18
SHA512 37e4e4dd2d0c03d00f7afb024406f7445142b82f24648da287ef9008805af6b083223e9d0a34fa343bf5dc0300c701f71151eebe9be459157daf10d0d5275689
SSDEEP 12288:aPSH3BnY7Y78MKc1yLt6OX2CqsfcTJalg7BBU0g+6qBeS02xdJXWhd3cEx5sCB94:ASH3qcqc1yRxtqW4alg7vgpj2zJmhdMx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xenorat

Malware Config

Extracted

Family

xenorat

C2

192.168.1.219

Mutex

131313131323

Attributes

delay
1000
install_path
temp
port
1234
startup_name
Windows Client

Signatures

Xenorat family
xenorat

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/SynapseX revamaped V1.3/Synapse X Installer.exe
unpack001/SynapseX revamaped V1.3/bin/OoxIi8qtt.exe

File Explorer

SynapseX.revamaped.V1.3.rar

.rar 659KB
SynapseX revamaped V1.3/Synapse X Installer.exe

.exe 43KB
SynapseX revamaped V1.3/auth/internal/3132e54eb7c.bin

2B
SynapseX revamaped V1.3/bin/OoxIi8qtt.exe

.exe 1.1MB

SynapseX.revamaped.V1.3.rar

SHA256 13f63c65ac270ce6d8f462791b1bb0ca64b8f7000f230b1c2ade64db617c5eac
MD5 25e767f22f576a1187ca297428a909b3
SHA1 a6ad4d278d09e0ecab07d095e996c91e9afb3b18
SHA512 37e4e4dd2d0c03d00f7afb024406f7445142b82f24648da287ef9008805af6b083223e9d0a34fa343bf5dc0300c701f71151eebe9be459157daf10d0d5275689
SSDEEP 12288:aPSH3BnY7Y78MKc1yLt6OX2CqsfcTJalg7BBU0g+6qBeS02xdJXWhd3cEx5sCB94:ASH3qcqc1yRxtqW4alg7vgpj2zJmhdMx
MD5 SHA1 SHA512 SSDEEP

SynapseX revamaped V1.3/Synapse X Installer.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 72e0f8bf690b647ae965d9a99f89c4f04c3b9500aac53f2a3fd376a2546b287a
MD5 769aad21a347b7576895910e55970390
SHA1 36831993993050af72ea201cfa6ebc4726860e56
SHA512 9bb36a376f0b3e8a26a813f1054bf92a9ca737bd9eb96403d28b4edb81c361408a058e5ccefda3e44bbf4943d9799203665161b02394d35a05faa20851f670a5
SSDEEP 768:d/jqPyqisr4dGirXAHg5rbWDdJwtZ69e7Sd/bDXNJb7bTDa/o1IV27C1:tNqwohJKZ69eKjBJb7bT2o1IgC1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

50110

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

SynapseX revamaped V1.3/bin/OoxIi8qtt.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a6e52cc20913ae168b7dcbb923ea8cd7bdda93e43399ec22a85dabfab14ddf3a
MD5 a48d6b525da2501d8ec661f2f2f1b0e8
SHA1 5737e465e5ffbed6b51e6775b5e05b5769f89e6b
SHA512 3cf1d6acbf1a3c3e99739af505b57aef7e8db5a2a84db2310c1d6490a097e11065510d2aaaac6ea71fd226b421d87be216993528e245e0bdee9b6000e68e32ab
SSDEEP 24576:5EvX2R7XLISXF8ElQlt8K9MlOZNsST2R7:qvX2VLIS2Jt89LST2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

979674

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

SynapseX.revamaped.V1.3.rar

SynapseX revamaped V1.3/Synapse X Installer.exe

mscoree

dotnet

SynapseX revamaped V1.3/auth/internal/3132e54eb7c.bin

SynapseX revamaped V1.3/bin/OoxIi8qtt.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

SynapseX.revamaped.V1.3.rar

SynapseX revamaped V1.3/Synapse X Installer.exe

mscoree

dotnet

SynapseX revamaped V1.3/auth/internal/3132e54eb7c.bin

SynapseX revamaped V1.3/bin/OoxIi8qtt.exe

mscoree

dotnet