chaos | Xeno_Exec[.]exe | Triage

Sharing

General

Target

Xeno_Exec.exe
Size

5.4MB
MD5

d8adc7b5885b14d5125bb9b10e0b32f2
SHA1

0639fbeb424dfd244ed87a9950482fa22de1564e
SHA256

145628cc523376793c93e65994ecc6c509bf107783892d2ca7a39766d150daec
SHA512

2493a37fb69cef034428758c93c127da7faecea4ece03cf33fe462dd1cfba43375bdce2a23a09bed605cc4a7ac278a4a94b73e4947ca314e039398e085a5a7b6
SSDEEP

49152:iuKIx29kk3sN2rEt/U964aKjSEvoYY+A2N:

Score

10^/10

chaos

Malware Config

Signatures

Chaos Ransomware 1 IoCs

resource	yara_rule
sample	family_chaos

Chaos family
chaos

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Xeno_Exec.exe

Files

Xeno_Exec.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ