xehook | bulk-download[.]rl[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
bulk-download.rl.zip
Size 119KB
Sample240914-td83kasfnc
SHA256 676498f292b3a47c39fadd65d8400735c92d0453aa627b1013cb4fe5a100be2d
MD5 06410427f6646ca85b63af8a45def7a7
SHA1 2b309bafd7846015d34f561546aca5e7a669f595
SHA512 6ba130d386146af99c928adc3e44e50a4f1ff7a6329b3e4395a7981842484601ceaf9e9fecc556d8b10a8397ac93f569d8a6d131343aad7a0f61bdd9905ee795
SSDEEP 3072:O/Jxq80jdCZBlX1pktW6yMFANtwGn0sxZVmmKyklk:wajsZlpkgtXVzjQFyek
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xehook

Malware Config

Extracted

Family

xehook

Version

2.1.5 Stable

https://t.me/+w897k5UK_jIyNDgy

Attributes

id
208
token
xehook208262680500151

Signatures

Xehook family
xehook

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/1d4946ea77a2bcf432f490d0a38429102a51069b
unpack001/d1f0f17e91e91cc4e1647c2aa8a7f39af2793125

File Explorer

bulk-download.rl.zip

.zip 119KB
1d4946ea77a2bcf432f490d0a38429102a51069b

.exe 151KB
d1f0f17e91e91cc4e1647c2aa8a7f39af2793125

.exe 168KB

bulk-download.rl.zip

SHA256 676498f292b3a47c39fadd65d8400735c92d0453aa627b1013cb4fe5a100be2d
MD5 06410427f6646ca85b63af8a45def7a7
SHA1 2b309bafd7846015d34f561546aca5e7a669f595
SHA512 6ba130d386146af99c928adc3e44e50a4f1ff7a6329b3e4395a7981842484601ceaf9e9fecc556d8b10a8397ac93f569d8a6d131343aad7a0f61bdd9905ee795
SSDEEP 3072:O/Jxq80jdCZBlX1pktW6yMFANtwGn0sxZVmmKyklk:wajsZlpkgtXVzjQFyek
MD5 SHA1 SHA512 SSDEEP

Password

infected

1d4946ea77a2bcf432f490d0a38429102a51069b

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 583c1eb6360379032d7cf7e6a60e09cfe74c7ecd36174016f293b060537fa52d
MD5 f635582929e0b0f2f18e1ee1fb7a84e9
SHA1 1d4946ea77a2bcf432f490d0a38429102a51069b
SHA512 0a4ac0362ebf4ce81fb187d93898e3ffdf74e6a0da96913818ebbb59a236a3897ec680cdc4599a9cf8cee8f8b7d527c4fc0abf89016bab48449995d10065d1e7
SSDEEP 3072:mQHKadVFHUg2HiFI9ifi5iLLbyq8QL+wI7BJlwEKctby:BqSF/2HQlLLbyq8QL+wI7BJiEK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

159982

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d1f0f17e91e91cc4e1647c2aa8a7f39af2793125

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 771fb65b9e55db17bca18ea3594e8e8b4d5ef060919844c0641a02d9c3326b1e
MD5 8df48db76679f51e832e0b48a89c509d
SHA1 d1f0f17e91e91cc4e1647c2aa8a7f39af2793125
SHA512 0e387586091b5455feb19fdfd45cea73f425cf1b8cc8fdc11e68d78826e30f3d148731713c796c0106aee1e756c514fa8ecade656261edc517333245170596c8
SSDEEP 3072:ELUbqjhjDUyx4HCIRoL57WpTlbYsb+L5QgDgZFHdrLTc5wEKctIZ:h4jJ4ORWpTlbYsb+L5QgDgZFHdrLTcml
MD5 SHA1 SHA512 SSDEEP