General

  • Target

    fuck.exe

  • Size

    480KB

  • Sample

    240908-p7naqsxcpj

  • MD5

    041ab886cac2a8e2b79fc486390d5510

  • SHA1

    30625cd6be8c5c2603cae540034948aa71022d97

  • SHA256

    4f179bb1925c0adf5cb44697a3f0986bd17bc65de686084641ef22c0a75b0a28

  • SHA512

    7aa4a6dc2c168c9b8de6ddc4f14f632f6d42017f46acc6dbb23b12969c03d9d17def89f062b4a37354691e06f227f4f4d95ef0c2f87b3b798bf58836ae10e6e4

  • SSDEEP

    12288:U+En/eRuTRgPZOZUtRJbZTzPk99GstRUvo9PR0KZYEDop5k5q70zlDbjflq54GaT:ejTREtRJb9TT

Malware Config

Extracted

Family

xehook

Version

2.1.5 Stable

C2

https://t.me/+w897k5UK_jIyNDgy

Attributes
  • id

    301

  • token

    xehook301447049203312

Targets

    • Target

      fuck.exe

    • Size

      480KB

    • MD5

      041ab886cac2a8e2b79fc486390d5510

    • SHA1

      30625cd6be8c5c2603cae540034948aa71022d97

    • SHA256

      4f179bb1925c0adf5cb44697a3f0986bd17bc65de686084641ef22c0a75b0a28

    • SHA512

      7aa4a6dc2c168c9b8de6ddc4f14f632f6d42017f46acc6dbb23b12969c03d9d17def89f062b4a37354691e06f227f4f4d95ef0c2f87b3b798bf58836ae10e6e4

    • SSDEEP

      12288:U+En/eRuTRgPZOZUtRJbZTzPk99GstRUvo9PR0KZYEDop5k5q70zlDbjflq54GaT:ejTREtRJb9TT

    • Xehook stealer

      Xehook is an infostealer written in C#.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks