General

  • Target

    X‍e‍n‍о‍.rar

  • Size

    72.6MB

  • MD5

    a422c5411053c6f499fbfea63ec777da

  • SHA1

    0b1e092dd5ac617962950ba3749e709b16b8b465

  • SHA256

    93921335cc29cdda0f4ad5f90d1ef136ab12518eff4a13388b485acfba14e863

  • SHA512

    5f4b8b385da311b8c8d220f46b99937f1e6f8882d0df4d375f9b281d0f0c2596f4aa0c2d4eb8d2fb48f77b96f270d41cfc8248f65d9b65fdbb701108ba63ee34

  • SSDEEP

    1572864:Zu1L/BEah59KRQ4JwTUckcSPuDoXWKfYh6DhhkY10UjqFNdyej30UurOC4:Nq9edwLk5GDAYWvkYZjQNd/gS

Score
9/10

Malware Config

Signatures

  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • X‍e‍n‍о‍.rar
    .rar

    Password: xeno

  • Executor/Xeno.exe
    .exe windows:6 windows x86 arch:x86

    Password: xeno

    4f2f006e2ecf7172ad368f8289dc96c1


    Headers

    Imports

    Sections

  • Executor/autoexec/test.lua
  • Executor/autoexec/test2.lua
  • Executor/locales/af.pak
  • Executor/locales/am.pak
  • Executor/locales/ar.pak
  • Executor/locales/bg.pak
  • Executor/locales/bin/api
    .dll regsvr32 windows:5 windows x86 arch:x86

    Password: xeno

    a9fd3e7f71a802c8eee0a502f46de991


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor/locales/bn.pak
  • Executor/locales/ca.pak
  • Executor/locales/cs.pak
  • Executor/locales/da.pak
  • Executor/locales/de.pak
  • Executor/locales/el.pak
  • Executor/locales/en-GB.pak
  • Executor/locales/en-US.pak
  • Executor/locales/es-419.pak
  • Executor/locales/es.pak
  • Executor/locales/et.pak
  • Executor/locales/fa.pak
  • Executor/locales/fi.pak
  • Executor/locales/fil.pak
  • Executor/locales/fr.pak
  • Executor/locales/gu.pak
  • Executor/locales/he.pak
  • Executor/locales/hi.pak
  • Executor/locales/hr.pak
  • Executor/locales/hu.pak
  • Executor/locales/id.pak
  • Executor/locales/it.pak
  • Executor/locales/ja.pak
  • Executor/locales/kn.pak
  • Executor/locales/ko.pak
  • Executor/locales/lt.pak
  • Executor/locales/lv.pak
  • Executor/locales/ml.pak
  • Executor/locales/mr.pak
  • Executor/locales/ms.pak
  • Executor/locales/nb.pak
  • Executor/locales/nl.pak
  • Executor/locales/pl.pak
  • Executor/locales/pt-BR.pak
  • Executor/locales/pt-PT.pak
  • Executor/locales/ro.pak
  • Executor/locales/ru.pak
  • Executor/locales/sk.pak
  • Executor/locales/sl.pak
  • Executor/locales/sr.pak
  • Executor/locales/sv.pak
  • Executor/locales/sw.pak
  • Executor/locales/ta.pak
  • Executor/locales/te.pak
  • Executor/locales/th.pak
  • Executor/locales/tr.pak
  • Executor/locales/uk.pak
  • Executor/locales/ur.pak
  • Executor/locales/vi.pak
  • Executor/locales/zh-CN.pak
  • Executor/locales/zh-TW.pak
  • Executor/scripts/Dex.lua
    .js
  • Executor/scripts/Infinite Yield.lua
    .js
  • Executor/scripts/Sine Wave.lua
  • Executor/scripts/Spinning Donut.lua
  • Executor/scripts/UNCCheckEnv.lua
    .js
  • Executor/workspace/.tests/appendfile.txt
  • Executor/workspace/.tests/getcustomasset.txt
  • Executor/workspace/.tests/isfile.txt
  • Executor/workspace/.tests/listfiles/test_1.txt
  • Executor/workspace/.tests/listfiles/test_2.txt
  • Executor/workspace/.tests/loadfile.txt
  • Executor/workspace/.tests/readfile.txt
  • Executor/workspace/.tests/writefile
  • Executor/workspace/.tests/writefile.txt
  • Executor/workspace/EzHubLL.txt
  • Executor/workspace/IY_FE.iy
  • Executor/workspace/Sky Hub/Sky Hub Settings.json