Resubmissions
29-08-2024 08:01
240829-jwkskssgnp 10Behavioral task
behavioral1
Sample
xs.exe
Resource
win7-20240704-en
General
-
Target
xs.exe
-
Size
45KB
-
MD5
104a64376edf7d06e889e2fcc8e6e62b
-
SHA1
7b7deb77061f44e6a0bb00f689361dc50e0c6ffe
-
SHA256
8d8e2512c933655992aae67eb76c97d5faafa9b2f99baf4e6916a4b398288f8d
-
SHA512
af9bac66d17df421ade13ab4b9c3fcde5654c35cfb57e7ff85aa5288496077a678437c60fb225c85f39aa7aed2dab9a4523996640c37559243c37b355be5b9a2
-
SSDEEP
768:tdhO/poiiUcjlJInlzH9Xqk5nWEZ5SbTDafWI7CPW5V:jw+jjgndH9XqcnW85SbTeWId
Malware Config
Extracted
xenorat
lyrics-contest.gl.at.ply.gg
Xeno_rat_nd8912d
-
delay
5000
-
install_path
nothingset
-
port
47112
-
startup_name
nothingset
Signatures
-
Xenorat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource xs.exe
Files
-
xs.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ