Overview
overview
10Static
static
10image logg...der.py
windows11-21h2-x64
3image logg...V2.exe
windows11-21h2-x64
10image logg...der.py
windows11-21h2-x64
3image logg...11.pyc
windows11-21h2-x64
3image logg...11.pyc
windows11-21h2-x64
3image logg...ion.py
windows11-21h2-x64
3image logg...ief.py
windows11-21h2-x64
3image logg...ate.py
windows11-21h2-x64
3image logg...ter.py
windows11-21h2-x64
3image logg...upx.py
windows11-21h2-x64
3General
- Target image logger V2.zip
- Size 163KB
- Sample240908-25bkdaserf
- SHA256 6f627ccaede437d4768d2bd22d6f9172077d45f239a1aeec8eaa75cf0f2f6f4d
- MD5 e5849c5c4b94626f2efe6e1484e39471
- SHA1 bc55f5c6dca017f2d090b006003abf6bd540a3bf
- SHA512 d8696f0a782d890c66b7a1bb5a0106eda19f13c0da553211923043da2669c594eee7dc567b30e13b5e12661cf8bce5c34fc8dc0cd8b3aa81c01d98b0ebc544ea
- SSDEEP 3072:0Hn8b/nedxj2zqZkfJfw+jqX491UbTKzT+1kUPR/yOKqpnfq5N0:oyqZkfqWd91UbnzP8Olc0
- MD5 SHA1 SHA512 SSDEEP
Behavioral task
behavioral1
Sample
image logger V2/builder.py
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
image logger V2/imageloggerV2.exe
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
image logger V2/loader.py
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
image logger V2/tools/__pycache__/sigthief.cpython-311.pyc
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
image logger V2/tools/__pycache__/upx.cpython-311.pyc
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
image logger V2/tools/obfuscation.py
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
image logger V2/tools/sigthief.py
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
image logger V2/tools/update.py
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
image logger V2/tools/updater.py
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
image logger V2/tools/upx.py
Resource
win11-20240802-en
Malware Config
Extracted
-
xenorat
-
192.168.1.164
-
delay
5000
-
install_path
nothingset
-
port
4444
-
startup_name
java updater
Targets
-
- Target image logger V2/builder.py
- Size 47KB
- SHA256 1619c0ac9446408cb9ef09c2aeceee06883a9dc3ee527f6aa302436a5709a04d
- MD5 6244204ef58c4de2e459f9a4bb520635
- SHA1 fe74e028e4528147cfa7a657cbe091bf6c565d27
- SHA512 e20911eeb1abba404f41eec215aa3e4f8eb4e0725131541462dd40290a34cae4f0f8ff3d50f7f176c796d37a8cbcde0edaeffa85cc6611cf0ae2f2d0e131552c
- SSDEEP 768:ZIWv2dyd4tCyGdHXYHg8VShYVh9Fbedxkk2zWtZkfb:ZIWvkGd0gWyY/bbedxj2zqZkfb
- MD5 SHA1 SHA512 SSDEEP
Score3/10 -
- Target image logger V2/imageloggerV2.exe
- Size 45KB
- SHA256 a64fb3bf19974ad4369f1cbf8ab7cd5cf598462fb623788f9fd51b86b8361839
- MD5 7b4b9400a241fff39ed69caf21a2bfff
- SHA1 418c0cce490a23fb0845bd1126cd40d573592ce0
- SHA512 dda3bdb11484b0f9ce83f39c7d9356fce18225775678a78d1454a1c943255b5f86a3f6deab19f575cf9596444031d97d13b62ecaa46c5c52f5c45df45b6020d0
- SSDEEP 768:pdhO/poiiUcjlJInWC2H9Xqk5nWEZ5SbTDanuI7CPW5R:nw+jjgnX2H9XqcnW85SbTKuIJ
- MD5 SHA1 SHA512 SSDEEP
-
Detect XenoRat Payload
-
- Target image logger V2/loader.py
- Size 651B
- SHA256 7b1f5c9368279f6ef42b6cf507990aa3bc6b74a69d6b987237e051e3db8c9f07
- MD5 b1ea45935d1e59c8864f8ff7cda184cc
- SHA1 b3c8590365273edfc33d1e2e495815595b58410c
- SHA512 06ad78ab9dee41d8cb472973dd6bd63fe22c0657c143e04d5647ca524f2ded1948adcdd4a2f052fdbb423d12f2d36f4a967b705cc3f68a8667ab3b86ddb21d1e
- MD5 SHA1 SHA512
Score3/10 -
- Target image logger V2/tools/__pycache__/sigthief.cpython-311.pyc
- Size 17KB
- SHA256 a135714390bc953a2d9add7c448fdcd004c604f4e1fcfd9baf9621a6d6fc20da
- MD5 7289dfc40ad03586b66ee32894af1570
- SHA1 66487020d17a5aa207074a0e0415fd8c799b7c0e
- SHA512 cb965b51510601b717214970b3e17b6df562f57ba655acd4aee441e4787e5bb7cce54e31685c8994e0ea6c257aeb7b4b6ff53daaca53c87abce18871cdbb5546
- SSDEEP 192:d+r3oEmxQlq2qYEqG2my7lIz29d8pRmBDvW2AjCIwxgpEnennnnnndnnnndVK1Ey:kExQY/YEqGqhISvBjtAjl1t8iu1
- MD5 SHA1 SHA512 SSDEEP
Score3/10 -
- Target image logger V2/tools/__pycache__/upx.cpython-311.pyc
- Size 3KB
- SHA256 a0069a2739d6c217d8f75e08cc9ca5c51d854cc1eb1ee20393e9a63ee04e22e0
- MD5 1d0b1dd6e5760da51110f5f6a0333396
- SHA1 16e73423dd73b53304d7180458a2aa65e295a50b
- SHA512 bb8c94f1d75f871ed8b6175dff6609d98d2e5d4200e7068a3658d0e0f6d075d9cc73ed631162012775e22726365ff5729231f57b2b87071bb638576b3209caff
- MD5 SHA1 SHA512
Score3/10 -
- Target image logger V2/tools/obfuscation.py
- Size 17KB
- SHA256 f16ebafbddde6335a329eb294bc5234cac3f2d36461a23b3ca0f5b0a5e3e1faa
- MD5 bda2bd11fe2b71638ec5260f223df3d6
- SHA1 8c5bc08206bfbdcec999e37b1a487f6e71016450
- SHA512 5b6e6b74898362e7f311f1b4ed67dd793afca9fafd810ef44e2fd815e738f858a270f92c652aa17096eb90b61bbaea33751f99b5fc5791e3167f1d14397ead3e
- SSDEEP 384:WyaTMf6XTC5sblt0uevZr9g7zDRULSNKw/TKpVqNry1Ifq5aM:WPXBkOPSqpymfq5z
- MD5 SHA1 SHA512 SSDEEP
Score3/10 -
- Target image logger V2/tools/sigthief.py
- Size 10KB
- SHA256 9b7c335f3898b7b2564d1ab484c0b271a8c0e6ea679cf1390d1e6fce2553517a
- MD5 1be0d01d21dbb3751282eb7ed647873b
- SHA1 e475be8d256eec456f64cbd5d3f603fb6aa7be6b
- SHA512 a934697fa989a414bfe889d36ffebf7001718f1005351bd51f9ef8b4727b9f08da9f10c23b970af8c63dcdaa0f7babcf200d863c8cc69f6eaa63d300f7a07cdf
- SSDEEP 192:gPj5U9+6E0yWYSF/DwI6CRH2dCYwqSfU15dkAJH:gKyMSfUU1l
- MD5 SHA1 SHA512 SSDEEP
Score3/10 -
- Target image logger V2/tools/update.py
- Size 2KB
- SHA256 58ce253dc08b47731e3ec7deebff297240cf7351ec3a832a3ca0c9a9dd55efb1
- MD5 8a6e292241e15194d5575bceae8dc70a
- SHA1 ebbd4a341940ee63a4b1e19064d4ea037c556991
- SHA512 9fd9e69d8d7d48b470c5d1630da6341d8b0bc2aa64a175291498e2592a45c8a8f372e8dcef5a8c18cc88d3467d3c42dea56ffdc4ba7b68988b38c5e64d157b09
- MD5 SHA1 SHA512
Score3/10 -
- Target image logger V2/tools/updater.py
- Size 1KB
- SHA256 a06bf52c9e9961015d098860e17b0b6710c4ad656f717287be4786471cd5000d
- MD5 b04f85b20f9061916b7248423867640c
- SHA1 0fd79334f83e4714e7dae46fceba0b2a572c2cf1
- SHA512 3b2bd15cf4685e49bf78a1279857b4bca6c36c4b2164f7b67b7129b60cbbc53cdb7560841e1c641945f7c9e5e6dd15db995040a625ca1b1b144d37851bddb436
- MD5 SHA1 SHA512
Score3/10 -
- Target image logger V2/tools/upx.py
- Size 1018B
- SHA256 4e243cf291985108ca727b92ffe43a74af6e4b692846572b0aa147735278f844
- MD5 cf4dbd207a5837c321d16355cb230ed6
- SHA1 a6748651608bc650b3c826d9b6feb224cca1fcab
- SHA512 e8565d325a38c5ab49ce142251b5205bb34dcfb5c1ba9b1a17bf403387fb8f5e95b5f8b95431298cf32fb7b7293adcc75bb490fb17465777b0e3c500df97839b
- MD5 SHA1 SHA512
Score3/10