xenorat | image logger V2[.]zip

resource	yara_rule
static1/unpack001/image logger V2/imageloggerV2.exe	family_xenorat

resource
unpack001/image logger V2/imageloggerV2.exe

image logger V2.zip

SHA256 6f627ccaede437d4768d2bd22d6f9172077d45f239a1aeec8eaa75cf0f2f6f4d
MD5 e5849c5c4b94626f2efe6e1484e39471
SHA1 bc55f5c6dca017f2d090b006003abf6bd540a3bf
SHA512 d8696f0a782d890c66b7a1bb5a0106eda19f13c0da553211923043da2669c594eee7dc567b30e13b5e12661cf8bce5c34fc8dc0cd8b3aa81c01d98b0ebc544ea
SSDEEP 3072:0Hn8b/nedxj2zqZkfJfw+jqX491UbTKzT+1kUPR/yOKqpnfq5N0:oyqZkfqWd91UbnzP8Olc0
MD5 SHA1 SHA512 SSDEEP

image logger V2/LICENSE.md

SHA256 e507e8174d5c92e39e0693f49ad4e14c43cd2f70d0549808cb620ad4bd45c21a
MD5 eba43ba58ddf1d214745d80c4c79da9e
SHA1 6cf9ac797ba52552c25c0479772f6b925c34aa0c
SHA512 593b0b30fbe8f3fe8ac0b0872844709140b4e3f2367039349e1d82734c9824074e5d0595a9df5037002027341d52fd9a4bd63d955995c52e554e7a921a0d7e4e
MD5 SHA1 SHA512

image logger V2/builder.py

SHA256 1619c0ac9446408cb9ef09c2aeceee06883a9dc3ee527f6aa302436a5709a04d
MD5 6244204ef58c4de2e459f9a4bb520635
SHA1 fe74e028e4528147cfa7a657cbe091bf6c565d27
SHA512 e20911eeb1abba404f41eec215aa3e4f8eb4e0725131541462dd40290a34cae4f0f8ff3d50f7f176c796d37a8cbcde0edaeffa85cc6611cf0ae2f2d0e131552c
SSDEEP 768:ZIWv2dyd4tCyGdHXYHg8VShYVh9Fbedxkk2zWtZkfb:ZIWvkGd0gWyY/bbedxj2zqZkfb
MD5 SHA1 SHA512 SSDEEP

image logger V2/cert

SHA256 432f27d6e3ac27fa407bf0b3e3bb1e277e5cae4233c52b26c12be4a786f77dad
MD5 9b87517f5ee3406073de22990c6641a6
SHA1 b576856c9e317b2a76fa3094cfe3d749546058b4
SHA512 802bf0c9cac62465f49e1776807d8be31d37b7cdbce1db04179ecab11943376e0634fb8ff3f744c76b0ba56df117ebea285e611410c8bab66aeddb05324abbc8
SSDEEP 192:9WiypcwKHnhWgN7acW4ox6RMySX01k9z3ArOy/95D:jdHRN7FMR9z8F7D
MD5 SHA1 SHA512 SSDEEP

image logger V2/imageloggerV2.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a64fb3bf19974ad4369f1cbf8ab7cd5cf598462fb623788f9fd51b86b8361839
MD5 7b4b9400a241fff39ed69caf21a2bfff
SHA1 418c0cce490a23fb0845bd1126cd40d573592ce0
SHA512 dda3bdb11484b0f9ce83f39c7d9356fce18225775678a78d1454a1c943255b5f86a3f6deab19f575cf9596444031d97d13b62ecaa46c5c52f5c45df45b6020d0
SSDEEP 768:pdhO/poiiUcjlJInWC2H9Xqk5nWEZ5SbTDanuI7CPW5R:nw+jjgnX2H9XqcnW85SbTKuIJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect XenoRat Payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

51998

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

image logger V2/loader.py

SHA256 7b1f5c9368279f6ef42b6cf507990aa3bc6b74a69d6b987237e051e3db8c9f07
MD5 b1ea45935d1e59c8864f8ff7cda184cc
SHA1 b3c8590365273edfc33d1e2e495815595b58410c
SHA512 06ad78ab9dee41d8cb472973dd6bd63fe22c0657c143e04d5647ca524f2ded1948adcdd4a2f052fdbb423d12f2d36f4a967b705cc3f68a8667ab3b86ddb21d1e
MD5 SHA1 SHA512

image logger V2/requirements.txt

SHA256 2615ddf6f5e82d5828c72698497e363f235287c963cd85825807ce789b32d927
MD5 524dc5c681228a59d6cceea54223d008
SHA1 d683b389e79ceaec397fd2a18425c7294336ee20
SHA512 a2b0e7a648f15e5fe689a0f82cd869d6c7f1b23cb8da1dc4ef68e682bc9a5dc4b625934ad7d7379e345c7fc24df1f23017d2799b5bd3e3d16c0e77f910e1f843
MD5 SHA1 SHA512

image logger V2/tools/pycache/sigthief.cpython-311.pyc

SHA256 a135714390bc953a2d9add7c448fdcd004c604f4e1fcfd9baf9621a6d6fc20da
MD5 7289dfc40ad03586b66ee32894af1570
SHA1 66487020d17a5aa207074a0e0415fd8c799b7c0e
SHA512 cb965b51510601b717214970b3e17b6df562f57ba655acd4aee441e4787e5bb7cce54e31685c8994e0ea6c257aeb7b4b6ff53daaca53c87abce18871cdbb5546
SSDEEP 192:d+r3oEmxQlq2qYEqG2my7lIz29d8pRmBDvW2AjCIwxgpEnennnnnndnnnndVK1Ey:kExQY/YEqGqhISvBjtAjl1t8iu1
MD5 SHA1 SHA512 SSDEEP

image logger V2/tools/pycache/upx.cpython-311.pyc

SHA256 a0069a2739d6c217d8f75e08cc9ca5c51d854cc1eb1ee20393e9a63ee04e22e0
MD5 1d0b1dd6e5760da51110f5f6a0333396
SHA1 16e73423dd73b53304d7180458a2aa65e295a50b
SHA512 bb8c94f1d75f871ed8b6175dff6609d98d2e5d4200e7068a3658d0e0f6d075d9cc73ed631162012775e22726365ff5729231f57b2b87071bb638576b3209caff
MD5 SHA1 SHA512

image logger V2/tools/obfuscation.py

SHA256 f16ebafbddde6335a329eb294bc5234cac3f2d36461a23b3ca0f5b0a5e3e1faa
MD5 bda2bd11fe2b71638ec5260f223df3d6
SHA1 8c5bc08206bfbdcec999e37b1a487f6e71016450
SHA512 5b6e6b74898362e7f311f1b4ed67dd793afca9fafd810ef44e2fd815e738f858a270f92c652aa17096eb90b61bbaea33751f99b5fc5791e3167f1d14397ead3e
SSDEEP 384:WyaTMf6XTC5sblt0uevZr9g7zDRULSNKw/TKpVqNry1Ifq5aM:WPXBkOPSqpymfq5z
MD5 SHA1 SHA512 SSDEEP

image logger V2/tools/sigthief.py

SHA256 9b7c335f3898b7b2564d1ab484c0b271a8c0e6ea679cf1390d1e6fce2553517a
MD5 1be0d01d21dbb3751282eb7ed647873b
SHA1 e475be8d256eec456f64cbd5d3f603fb6aa7be6b
SHA512 a934697fa989a414bfe889d36ffebf7001718f1005351bd51f9ef8b4727b9f08da9f10c23b970af8c63dcdaa0f7babcf200d863c8cc69f6eaa63d300f7a07cdf
SSDEEP 192:gPj5U9+6E0yWYSF/DwI6CRH2dCYwqSfU15dkAJH:gKyMSfUU1l
MD5 SHA1 SHA512 SSDEEP

image logger V2/tools/update.py

SHA256 58ce253dc08b47731e3ec7deebff297240cf7351ec3a832a3ca0c9a9dd55efb1
MD5 8a6e292241e15194d5575bceae8dc70a
SHA1 ebbd4a341940ee63a4b1e19064d4ea037c556991
SHA512 9fd9e69d8d7d48b470c5d1630da6341d8b0bc2aa64a175291498e2592a45c8a8f372e8dcef5a8c18cc88d3467d3c42dea56ffdc4ba7b68988b38c5e64d157b09
MD5 SHA1 SHA512

image logger V2/tools/updater.py

SHA256 a06bf52c9e9961015d098860e17b0b6710c4ad656f717287be4786471cd5000d
MD5 b04f85b20f9061916b7248423867640c
SHA1 0fd79334f83e4714e7dae46fceba0b2a572c2cf1
SHA512 3b2bd15cf4685e49bf78a1279857b4bca6c36c4b2164f7b67b7129b60cbbc53cdb7560841e1c641945f7c9e5e6dd15db995040a625ca1b1b144d37851bddb436
MD5 SHA1 SHA512

image logger V2/tools/upx.py

SHA256 4e243cf291985108ca727b92ffe43a74af6e4b692846572b0aa147735278f844
MD5 cf4dbd207a5837c321d16355cb230ed6
SHA1 a6748651608bc650b3c826d9b6feb224cca1fcab
SHA512 e8565d325a38c5ab49ce142251b5205bb34dcfb5c1ba9b1a17bf403387fb8f5e95b5f8b95431298cf32fb7b7293adcc75bb490fb17465777b0e3c500df97839b
MD5 SHA1 SHA512

image logger V2/version.txt

SHA256 eb924ec331353a23de481b3e9caa4d5fd9e17c49893419e03fe85c1e9c78c47a
MD5 d120bd362d78f5948e3284dd2dfc005c
SHA1 f9055da4911f1b03ddcbf36db8930b11aba6720a
SHA512 fbb7f2c78e5cf1d8385dcad53877c5a2f2919769f9c2535065d5c7035cbf4ab95fbec1a9607062f9a5011ee0c6af3a2c49b9984129010dc4e0fa10f96fccb1ba
MD5 SHA1 SHA512

image logger V2.zip

image logger V2/LICENSE.md

image logger V2/builder.py

image logger V2/cert

image logger V2/imageloggerV2.exe

mscoree

dotnet

image logger V2/loader.py

image logger V2/requirements.txt

image logger V2/tools/pycache/sigthief.cpython-311.pyc

image logger V2/tools/pycache/upx.cpython-311.pyc

image logger V2/tools/obfuscation.py

image logger V2/tools/sigthief.py

image logger V2/tools/update.py

image logger V2/tools/updater.py

image logger V2/tools/upx.py

image logger V2/version.txt

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

image logger V2.zip

image logger V2/LICENSE.md

image logger V2/builder.py

image logger V2/cert

image logger V2/imageloggerV2.exe

mscoree

dotnet

image logger V2/loader.py

image logger V2/requirements.txt

image logger V2/tools/__pycache__/sigthief.cpython-311.pyc

image logger V2/tools/__pycache__/upx.cpython-311.pyc

image logger V2/tools/obfuscation.py

image logger V2/tools/sigthief.py

image logger V2/tools/update.py

image logger V2/tools/updater.py

image logger V2/tools/upx.py

image logger V2/version.txt

image logger V2/tools/pycache/sigthief.cpython-311.pyc

image logger V2/tools/pycache/upx.cpython-311.pyc