80c4016577c11791f64e2d43e1dfad2b01adf7276100400a4421b48df6e6fbfe

Resubmissions

21-12-2024 14:43

241221-r337ha1ndz 6

21-12-2024 14:43

241221-r3pzwa1phq 6

Sharing

Copy URL

Twitter E-mail

General

Target

Xeno-v1.1.0-x64.zip
Size

4.5MB
Sample

241221-r337ha1ndz
MD5

93357db14af91a53bcab556e80103c1c
SHA1

7643f56e7ceace571c7000b937275f747af659af
SHA256

80c4016577c11791f64e2d43e1dfad2b01adf7276100400a4421b48df6e6fbfe
SHA512

5a46cb9f2a3ce090eb44e57609dd12bff268d5df09666ec1fb71f7e9f9d170a58994c4a5a1eef3e23fd91e08f3b47b6d90954cb9477017a71f81c1e1e950f1e4
SSDEEP

98304:9ooNYRM5U7aEg/d2OWTjSQxc7p9KK2P9nHGyZEW3T7fI:9ooNYe5ebg/dVUjqOK21mGEYT7fI

Score

6^/10

discovery execution

Malware Config

Targets

- Target
  
  Xeno-v1.1.0-x64/Install dependencies.bat
- Size
  
  1KB
- MD5
  
  eb4b04fbf3be04946d84a01ede5cbe9a
- SHA1
  
  c03837830a409c2ef177925bd3e4ec9544cc5031
- SHA256
  
  f545d644196419b41eadae3f0846888c396284cc148c780916c0d96a07f71b40
- SHA512
  
  42dae275458e8f23383285087cda5dad95bfee58bdb86dc1b6c07373296e35f99fd3c249fe022a5bbd3e9b0a465b6231922267fb330d6b5febeb7a731d320749
Score

1^/10
behavioral1 behavioral2
- Target
  
  Xeno-v1.1.0-x64/Microsoft.Web.WebView2.Core.dll
- Size
  
  557KB
- MD5
  
  b037ca44fd19b8eedb6d5b9de3e48469
- SHA1
  
  1f328389c62cf673b3de97e1869c139d2543494e
- SHA256
  
  11e88b2ca921e5c88f64567f11bd83cbc396c10365d40972f3359fcc7965d197
- SHA512
  
  fa89ab3347fd57486cf3064ad164574f70e2c2b77c382785479bfd5ab50caa0881de3c2763a0932feac2faaf09479ef699a04ba202866dc7e92640246ba9598b
- SSDEEP
  
  12288:6CxswUBor35JrpQ322zy+uFKcDoRFNCMmeA+imQ269pRFZNIEJdIEY0lxEIPrEIE:6Cbmv
Score

1^/10
behavioral3 behavioral4
- Target
  
  Xeno-v1.1.0-x64/Microsoft.Web.WebView2.WinForms.dll
- Size
  
  37KB
- MD5
  
  8153423918c8cbf54b44acec01f1d6c2
- SHA1
  
  f0c3c5412b809725e6d4809230adb15cc7d83ad2
- SHA256
  
  5696366f7458da940cc986dc5d3d4549a2368512acd769014ecbb07b47bd88b4
- SHA512
  
  f3dc771e37c71479d332142ec5a9c5c3f39ca71937f595a0f7482ae5aaaafd92e932efc9b0363d4511d547f3c8b2e0497ebbf8356e7d07fc344f4e5715b0ee87
- SSDEEP
  
  768:1sjCEEHJ9l0EeFZ2sxIHzttZDgcEST3p4Jjrjh2jJ+SG2au8vxJKia5/Zi/ZGQKk:wCEB15azttZDgcEST3p4JjrjaJ+SG2a/
Score

1^/10
behavioral5 behavioral6
- Target
  
  Xeno-v1.1.0-x64/Microsoft.Web.WebView2.Wpf.dll
- Size
  
  50KB
- MD5
  
  4a292c5c2abf1aab91dee8eecafe0ab6
- SHA1
  
  369e788108e5fb0608a803fa2e5a06690b4464b5
- SHA256
  
  b628d6133bf57b7482a49aa158e45b078df73ee7d33137ac1336d24ac67ed1b4
- SHA512
  
  ca22adfff9789730e4c02343e320d80b8466cfc5a15f662cefe376b7ee29dea571004c1c26cd3f50c0d24e646f2b36b53fa86835678f46f335d65eec52431cde
- SSDEEP
  
  1536:gpGhWMhWLF9jwKi8LDP/ryEH0GBy4JjrD1aah/UaOzk6hKKa5/Bi/IGCv0Z0T6Cc:taBi8LDP/b0GBy4JjrD1aah/UaOzk6hz
Score

1^/10
behavioral7 behavioral8
- Target
  
  Xeno-v1.1.0-x64/Newtonsoft.Json.dll
- Size
  
  695KB
- MD5
  
  adf3e3eecde20b7c9661e9c47106a14a
- SHA1
  
  f3130f7fd4b414b5aec04eb87ed800eb84dd2154
- SHA256
  
  22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07
- SHA512
  
  6a644bfd4544950ed2d39190393b716c8314f551488380ec8bd35b5062aa143342dfd145e92e3b6b81e80285cac108d201b6bbd160cb768dc002c49f4c603c0b
- SSDEEP
  
  12288:mFIM0KteTMN4Or4D3OdmZg5WHEaEDIGBBjgrIQtD+tVqDMW:6zMTMNNd+g5Wk78GBBjgrIQtDF
Score

1^/10
behavioral10 behavioral9
- Target
  
  Xeno-v1.1.0-x64/Xeno.dll
- Size
  
  1.3MB
- MD5
  
  538ce914853d942471aca19f7344ee45
- SHA1
  
  d34ea715f5ac65a61f753119ec1534dd712a37e1
- SHA256
  
  887ea84d65f10821d48dcb3678dc8834338d1e2e13915f6b6b02971a2fb0bcf2
- SHA512
  
  f487a9c7cd301ecc51b8f5890e1aa223b9f4373aba3e75d71cba0e3bcbdf7032a365bd23e8ae19520bfa90962c6cd36410bb7f83f8f173b25f2ec1f87592cd03
- SSDEEP
  
  24576:1IdKiywcIFdxMJm2yOCvDLuMyw+wwZzNggeCaGtNm1pKy:1IdKiIgpvDKMz+9ZzNgKaK41z
Score

1^/10
behavioral11 behavioral12
- Target
  
  Xeno-v1.1.0-x64/Xeno.exe
- Size
  
  140KB
- MD5
  
  f0d6a8ef8299c5f15732a011d90b0be1
- SHA1
  
  5d2e6cc0bd4f1e810808f2a284f6c2a30b21edcf
- SHA256
  
  326bae0bd1398234dcef4c3d71f00e30cc9b447fa963e21d6f29605f42bb7e5b
- SHA512
  
  5b9f1517949a7fa9fdb7413146632d21a4208dc92823b673af85963ae5cc7f827b3ba27f3e9c5554c45e726ad159aac77d30306acc3559bd8712534e41ff0f27
- SSDEEP
  
  3072:2hK4Uay3XrQ8habqgp9pC9Z6p5uf3C6k0xuZ04ntfxDhBury:2hK4XycqgpfCup5sVxuZ04bhA
Score

6^/10

discovery
- Legitimate hosting services abused for malware hosting/C2
behavioral13 behavioral14
- Target
  
  Xeno-v1.1.0-x64/XenoUI.dll
- Size
  
  95KB
- MD5
  
  0c693fdf5031de28e139121866d4e71f
- SHA1
  
  d4e3f81ce0ac00efbc537b6aa4ebc07f039aaf9a
- SHA256
  
  3788b42e87c69c077868856b07c03e8606e0f49389c947231701100d99337e1c
- SHA512
  
  4298a579eea032e794ac4aaa2e18c793fbe0d3f33a2f8e948fde510427e604f06072b71703183c9ca88c73a805627187241f47845a9f16822243388ae5cb42af
- SSDEEP
  
  1536:gOTgjZ0JbSfMuafhOWR42zxMVY6dTPr/Wa5iiphLuM/APHV5y6SlSW8zXR:bT+WytdTPr/WAbK7Pby6S+zXR
Score

1^/10
behavioral15 behavioral16
- Target
  
  Xeno-v1.1.0-x64/XenoUI.exe
- Size
  
  140KB
- MD5
  
  f0d6a8ef8299c5f15732a011d90b0be1
- SHA1
  
  5d2e6cc0bd4f1e810808f2a284f6c2a30b21edcf
- SHA256
  
  326bae0bd1398234dcef4c3d71f00e30cc9b447fa963e21d6f29605f42bb7e5b
- SHA512
  
  5b9f1517949a7fa9fdb7413146632d21a4208dc92823b673af85963ae5cc7f827b3ba27f3e9c5554c45e726ad159aac77d30306acc3559bd8712534e41ff0f27
- SSDEEP
  
  3072:2hK4Uay3XrQ8habqgp9pC9Z6p5uf3C6k0xuZ04ntfxDhBury:2hK4XycqgpfCup5sVxuZ04bhA
Score

6^/10

discovery
- Legitimate hosting services abused for malware hosting/C2
behavioral17 behavioral18
- Target
  
  Xeno-v1.1.0-x64/bin/Monaco/index.html
- Size
  
  164KB
- MD5
  
  001dcbb8f41cdcbf9b4d1e3a0ed4b2d2
- SHA1
  
  982a05814546017c40771e59e7677b53d84787e9
- SHA256
  
  f1d2c52f2803c29585b81d2eff74c56242d27e9619ee6d38081d5604c5bb1951
- SHA512
  
  9a4eba2a9314b6f5851997e1db0ecfae8e40da3443d8a5f9df933ccf6a4d75fc330888c8d14818326e15b3dec9ae2f5f7e73cd08c3822dd7eb0b2d753c8cd8fa
- SSDEEP
  
  3072:Nk4J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pblM:64J09BA3pZaFD48VOAGUWYPjdlLJbRBS
Score

6^/10

discovery
- Legitimate hosting services abused for malware hosting/C2
behavioral19 behavioral20
- Target
  
  Xeno-v1.1.0-x64/bin/Monaco/vs/base/worker/workerMain.js
- Size
  
  133KB
- MD5
  
  d0ac5294c58e523cddf25bc6d785fa48
- SHA1
  
  1b3661b6db36f1b14fd80dc9a739bfc69c68dfe5
- SHA256
  
  e90d1a8f116fa74431117a3ad78dde16dde060a4bf7528dfe3d5a3ad6156504b
- SHA512
  
  fea07a1ea5d29a3b4c614248655f4d1ddd94c10c6a6b5c8b428a8b4c0cbec7e7492fa0665c5001e65ce167240ffdfc5ac2c2ed14da3d6f508ae8d8b3c8e8eebb
- SSDEEP
  
  3072:bzjH/zYJc5c/7tMLrJ78II4F9N8+em5W+:XjH/zYJc5c/76LrJ78I7BL
Score

3^/10

execution
behavioral21 behavioral22
- Target
  
  Xeno-v1.1.0-x64/bin/Monaco/vs/basic-languages/lua/lua.js
- Size
  
  4KB
- MD5
  
  eebda1fdd970433750c115eae2f03865
- SHA1
  
  3f1a1cddb99dead013eac825eb418241656d4bf0
- SHA256
  
  ac729efb3164f48d6b08f74d4b15060c126a30d40fb4cd4fc9cc94f2e19bd7c7
- SHA512
  
  8b188f3ae73a14a9318dce9761312d9dd2360ab00ee36e83ca6b74288a109c91770954db7537fd84a76707a1e79528fffc97f3a718bcd924545b469a1363c9cb
- SSDEEP
  
  96:HDGAW6FJJJkCO8evcIWtdrvrg+1/sLMiWAOKjLobLMzD:BWCDqC20IWtZD92pzOKvomD
Score

3^/10

execution
behavioral23 behavioral24
- Target
  
  Xeno-v1.1.0-x64/bin/Monaco/vs/editor/editor.main.js
- Size
  
  2.1MB
- MD5
  
  2dc0068cdbc03ce43a75ab0b2df664e2
- SHA1
  
  817a209e179466dc8a14e05eb11a6c1b7e3d71eb
- SHA256
  
  b604b6148f70fe9db882cce2a7d327b2422ad2f203a805491002a8c564e3c3ff
- SHA512
  
  1ce29ed21e027d3552dc05162250bd62d66555f7b9ff48c9c94116d1e696089c32851533e7db30a7507a85b598df8fbf66292904c446536ccd3b2c60209d9d3d
- SSDEEP
  
  24576:jFFExk98EXl2uRJxjP3Ddv6QLtQ2MbRpn:Yxk98EXl2ixjP3Ddv6QLtdMf
Score

3^/10

execution
behavioral25 behavioral26
- Target
  
  Xeno-v1.1.0-x64/bin/Monaco/vs/editor/editor.main.nls.de.js
- Size
  
  46KB
- MD5
  
  d1fd2fb756c73970b9c5e0ba07bff708
- SHA1
  
  470057b3244886dccc9f6074297cc8bc2a9c1b39
- SHA256
  
  cb1c3416ff242a738c45c3b2590d7d222b159a95a69ce3b7b8d7c8d18ea70828
- SHA512
  
  db2432182ff4c85fcca5093d0e433ed9cf5bed3ea3db9ed82fedc87af4d260e0d0f29ff67f0b8ac78e162586a74998ad082a91e8f9a76717827a83d5b2f775cf
- SSDEEP
  
  768:ocuLC1xYdRB1a3Xq1GdigBoQqAaI/QQUEYPxFpXT1kF7bJZYmz7lehjDWMQRBk3Z:oclxgVuXq1GdiRQqAaI/QvEYPxFpDkbg
Score

3^/10

execution
behavioral27 behavioral28
- Target
  
  Xeno-v1.1.0-x64/bin/Monaco/vs/editor/editor.main.nls.es.js
- Size
  
  46KB
- MD5
  
  36f546b28ca17ece9f8eb9bcf8344e13
- SHA1
  
  d43934b9041587799e332b2f568aa81666227258
- SHA256
  
  327437ee3793e9ae0686c78196b459592c282ed2e86f95ce28d32693b76d7654
- SHA512
  
  13f8cc23038c07b6840514db4fc7b503b7a38ae1ec3baab44f1bfbded40ac50ae03c05c754f9678eecd0c8fcefab958152b39b731068b8c2c976c4c57e97f36d
- SSDEEP
  
  768:oX8nKFyVgAYwTQG8zHqIkGMvnmvoKA9OfxjB3EVuU13pjbazPn0ANy7+IkLDKPp9:oMKFyVRcdzHqIkGMvnmvoKA9OfxjB3E5
Score

3^/10

execution
behavioral29 behavioral30
- Target
  
  Xeno-v1.1.0-x64/bin/Monaco/vs/editor/editor.main.nls.fr.js
- Size
  
  49KB
- MD5
  
  1a29080733878dd44e0c118e84cd0c39
- SHA1
  
  60c158e23962b11918f6cae26445fad5b63bc65a
- SHA256
  
  6ed837dc1905c06a20d102921ff06a0bda003c5368ed0576bf7e69494e889ae8
- SHA512
  
  5cc68cabb583100320d7c875fd7c46f5c618c3968ac2a7c2b60f90ec74b29349a557049c17d5c851cabb54d5ef26cd65e8d2288d70b62ede06ee1762e25dbd60
- SSDEEP
  
  768:op8flgb2uZ5CcXQ6Q3edz3uzATaY3l0y+wj90TWIvkU5BkREPTtOjNjZocYV3A4k:owliv5Ccg67SATaYVKPkRskjNGBAa3k
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Legitimate hosting services abused for malware hosting/C2

Legitimate hosting services abused for malware hosting/C2

Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32