Overview

overview

10

Static

static

3

72a88efeda...43.exe

windows7-x64

7

72a88efeda...43.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    72a88efeda156c7304c5c8bd090dcb011ba3dfbbe91f5511969ba8eecee32843.exe

  • Size

    226KB

  • Sample

    241003-j6958axcka

  • MD5

    1c83b86ee49577920f79e0175f56a480

  • SHA1

    1ac4ef5a1f9ca34ac229bc26cdc914e38173c554

  • SHA256

    72a88efeda156c7304c5c8bd090dcb011ba3dfbbe91f5511969ba8eecee32843

  • SHA512

    d4b4ec415e92617548e863422f653b97460be182205871bf7526fe872d110e8ac17b60472d8351bed62e20ee584424816eeafcafe69ce096596ee044e1df022d

  • SSDEEP

    6144:d281qBlr/yJ37jLL5dd+AFi7hIis2tvRPOI7Up7jGEFHw05jPNBV:d2Geqx3lb+DII7Up7qEp5jPNBV

Score
10/10
xehookcredential_accessdiscoverystealer

Malware Config

Extracted

Family

xehook

Version

2.1.5 Stable

C2

https://t.me/+w897k5UK_jIyNDgy

Attributes
  • id

    185

  • token

    xehook185786249114074

Targets

    • Target

      72a88efeda156c7304c5c8bd090dcb011ba3dfbbe91f5511969ba8eecee32843.exe

    • Size

      226KB

    • MD5

      1c83b86ee49577920f79e0175f56a480

    • SHA1

      1ac4ef5a1f9ca34ac229bc26cdc914e38173c554

    • SHA256

      72a88efeda156c7304c5c8bd090dcb011ba3dfbbe91f5511969ba8eecee32843

    • SHA512

      d4b4ec415e92617548e863422f653b97460be182205871bf7526fe872d110e8ac17b60472d8351bed62e20ee584424816eeafcafe69ce096596ee044e1df022d

    • SSDEEP

      6144:d281qBlr/yJ37jLL5dd+AFi7hIis2tvRPOI7Up7jGEFHw05jPNBV:d2Geqx3lb+DII7Up7qEp5jPNBV

    Score
    10/10
    discoveryxehookcredential_accessstealer

    • Xehook stealer

      Xehook is an infostealer written in C#.

      stealerxehook

    • Loads dropped DLL

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks