Overview

overview

10

Static

static

10

Xylo RR.exe

windows11-21h2-x64

8

[L�3�[.pyc

windows11-21h2-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Xylo RR.exe

  • Size

    12.0MB

  • Sample

    241002-1s387asfja

  • MD5

    618c8d10cb697b64f0c8f979836c2565

  • SHA1

    20a38a23cb028a26ca85e00a481ba0d09c54efc2

  • SHA256

    a3a75a2e1c05aefb61498290fc213ab9226cfed7ecd9146903812810b7ba8f27

  • SHA512

    6fac2a05bcb90e429e513402d81c07cd66cde766ebfffb75d93bc33c9339d9cd325e8a6e58650e308bb3f97a22d6995f928d8e4b2637ac8d291ed32e34b9341d

  • SSDEEP

    196608:KQT0yWVIOuL2aeNTfm/pf+xk4dWRptrbWOjgrC:pBTOPVy/pWu4kRptrbvMrC

Score
10/10
blankgrabberdiscoveryexecutionupx

Malware Config

Targets

    • Target

      Xylo RR.exe

    • Size

      12.0MB

    • MD5

      618c8d10cb697b64f0c8f979836c2565

    • SHA1

      20a38a23cb028a26ca85e00a481ba0d09c54efc2

    • SHA256

      a3a75a2e1c05aefb61498290fc213ab9226cfed7ecd9146903812810b7ba8f27

    • SHA512

      6fac2a05bcb90e429e513402d81c07cd66cde766ebfffb75d93bc33c9339d9cd325e8a6e58650e308bb3f97a22d6995f928d8e4b2637ac8d291ed32e34b9341d

    • SSDEEP

      196608:KQT0yWVIOuL2aeNTfm/pf+xk4dWRptrbWOjgrC:pBTOPVy/pWu4kRptrbvMrC

    Score
    8/10
    discoveryexecutionupx

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

    • Target

      [L�3�[.pyc

    • Size

      1KB

    • MD5

      62bb48edfc944ef42a6aa4f03dc01506

    • SHA1

      4834d62fe4712c7bec0f5bffe66a43a1a945358d

    • SHA256

      dd9788acf1ad3289414cb9627025c9638a6874d8f71626182f7f9c593a1eb477

    • SHA512

      ae5eda2c55b3867db03ace6be254135073f37fad3447a0f41bdd0ce658ed3996b6f81cf618d628a6ca5a0b7a182fb7071a9b49b938334b166a1b035c3ef9dcd3

    Score
    1/10
    behavioral2

MITRE ATT&CK Enterprise v15

Tasks