Overview

overview

6

Static

static

3

Xeno-v1.1....re.dll

windows7-x64

1

Xeno-v1.1....re.dll

windows10-2004-x64

1

Xeno-v1.1....ms.dll

windows7-x64

1

Xeno-v1.1....ms.dll

windows10-2004-x64

1

Xeno-v1.1....pf.dll

windows7-x64

1

Xeno-v1.1....pf.dll

windows10-2004-x64

1

Xeno-v1.1....on.dll

windows7-x64

1

Xeno-v1.1....on.dll

windows10-2004-x64

1

Xeno-v1.1....no.dll

windows7-x64

1

Xeno-v1.1....no.dll

windows10-2004-x64

1

Xeno-v1.1....no.exe

windows7-x64

3

Xeno-v1.1....no.exe

windows10-2004-x64

6

Xeno-v1.1....UI.exe

windows7-x64

1

Xeno-v1.1....UI.exe

windows10-2004-x64

1

Xeno-v1.1....-0.dll

windows10-2004-x64

1

Xeno-v1.1....-0.dll

windows10-2004-x64

1

Xeno-v1.1....-0.dll

windows10-2004-x64

1

Xeno-v1.1....-0.dll

windows10-2004-x64

1

Xeno-v1.1....-0.dll

windows10-2004-x64

1

Xeno-v1.1....-0.dll

windows10-2004-x64

1

Xeno-v1.1....-0.dll

windows10-2004-x64

1

Xeno-v1.1....-0.dll

windows10-2004-x64

1

Xeno-v1.1....x.html

windows7-x64

6

Xeno-v1.1....x.html

windows10-2004-x64

6

Xeno-v1.1....ain.js

windows7-x64

3

Xeno-v1.1....ain.js

windows10-2004-x64

3

Xeno-v1.1....lua.js

windows7-x64

3

Xeno-v1.1....lua.js

windows10-2004-x64

3

Xeno-v1.1....ain.js

windows7-x64

3

Xeno-v1.1....ain.js

windows10-2004-x64

3

Xeno-v1.1.....de.js

windows7-x64

3

Xeno-v1.1.....de.js

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Xeno-v1.1.3-x64.zip

  • Size

    4.8MB

  • Sample

    250120-k2xj1askaj

  • MD5

    520cabdf6c80e269166844c43015a77b

  • SHA1

    cf0f24a0d2f1c5ccbc3f7076363976809d72cf51

  • SHA256

    1dfcadf8afac3a217d8289f937801c4f85d0855b0697062dbd570eb1c2d1c47c

  • SHA512

    098974b0ef1b4a40c28361af2b2476600a068be4bbe9227fe4f5f425602ba5517e7e4c2ed50e4ba77645790dcce3c4ad6a5452188279f805b9f13ffab596bff7

  • SSDEEP

    98304:baD6OMy3rm+twdjTmDh/BRFQNM74slPUDtgo8/ihgu/DAA75aoJg3:mDUyb9tWjTml/3bZUpnUu/kCaoJg3

Score
6/10
discoveryexecution

Malware Config

Targets

    • Target

      Xeno-v1.1.3-x64/Microsoft.Web.WebView2.Core.dll

    • Size

      557KB

    • MD5

      b037ca44fd19b8eedb6d5b9de3e48469

    • SHA1

      1f328389c62cf673b3de97e1869c139d2543494e

    • SHA256

      11e88b2ca921e5c88f64567f11bd83cbc396c10365d40972f3359fcc7965d197

    • SHA512

      fa89ab3347fd57486cf3064ad164574f70e2c2b77c382785479bfd5ab50caa0881de3c2763a0932feac2faaf09479ef699a04ba202866dc7e92640246ba9598b

    • SSDEEP

      12288:6CxswUBor35JrpQ322zy+uFKcDoRFNCMmeA+imQ269pRFZNIEJdIEY0lxEIPrEIE:6Cbmv

    Score
    1/10
    behavioral1behavioral2

    • Target

      Xeno-v1.1.3-x64/Microsoft.Web.WebView2.WinForms.dll

    • Size

      37KB

    • MD5

      8153423918c8cbf54b44acec01f1d6c2

    • SHA1

      f0c3c5412b809725e6d4809230adb15cc7d83ad2

    • SHA256

      5696366f7458da940cc986dc5d3d4549a2368512acd769014ecbb07b47bd88b4

    • SHA512

      f3dc771e37c71479d332142ec5a9c5c3f39ca71937f595a0f7482ae5aaaafd92e932efc9b0363d4511d547f3c8b2e0497ebbf8356e7d07fc344f4e5715b0ee87

    • SSDEEP

      768:1sjCEEHJ9l0EeFZ2sxIHzttZDgcEST3p4Jjrjh2jJ+SG2au8vxJKia5/Zi/ZGQKk:wCEB15azttZDgcEST3p4JjrjaJ+SG2a/

    Score
    1/10
    behavioral3behavioral4

    • Target

      Xeno-v1.1.3-x64/Microsoft.Web.WebView2.Wpf.dll

    • Size

      50KB

    • MD5

      4a292c5c2abf1aab91dee8eecafe0ab6

    • SHA1

      369e788108e5fb0608a803fa2e5a06690b4464b5

    • SHA256

      b628d6133bf57b7482a49aa158e45b078df73ee7d33137ac1336d24ac67ed1b4

    • SHA512

      ca22adfff9789730e4c02343e320d80b8466cfc5a15f662cefe376b7ee29dea571004c1c26cd3f50c0d24e646f2b36b53fa86835678f46f335d65eec52431cde

    • SSDEEP

      1536:gpGhWMhWLF9jwKi8LDP/ryEH0GBy4JjrD1aah/UaOzk6hKKa5/Bi/IGCv0Z0T6Cc:taBi8LDP/b0GBy4JjrD1aah/UaOzk6hz

    Score
    1/10
    behavioral5behavioral6

    • Target

      Xeno-v1.1.3-x64/Newtonsoft.Json.dll

    • Size

      695KB

    • MD5

      adf3e3eecde20b7c9661e9c47106a14a

    • SHA1

      f3130f7fd4b414b5aec04eb87ed800eb84dd2154

    • SHA256

      22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07

    • SHA512

      6a644bfd4544950ed2d39190393b716c8314f551488380ec8bd35b5062aa143342dfd145e92e3b6b81e80285cac108d201b6bbd160cb768dc002c49f4c603c0b

    • SSDEEP

      12288:mFIM0KteTMN4Or4D3OdmZg5WHEaEDIGBBjgrIQtD+tVqDMW:6zMTMNNd+g5Wk78GBBjgrIQtDF

    Score
    1/10
    behavioral7behavioral8

    • Target

      Xeno-v1.1.3-x64/Xeno.dll

    • Size

      1.2MB

    • MD5

      66e8a6978c77e6b2f390f33d25bf7f01

    • SHA1

      b2b8bb5802da4035799794c62339ed65d4e112e4

    • SHA256

      eb9613002b39c02a2fc07d02ba99c162eac1a9c02596ab20a73a7bc1a64cbf48

    • SHA512

      5adfec69cb3e384997810dd15b428007c1aaa5bfaf2f6445a34178dd82099097e0d9fd678138382113ada0df4fa08619e75661369b6b9703e2ef45aabd7650b0

    • SSDEEP

      24576:42EAKywcoldvE7fznOCTtOmQbwI34r3e78veEoxetwpKc:42EAKOPpTtxiwi4r3e78dlw

    Score
    1/10
    behavioral10behavioral9

    • Target

      Xeno-v1.1.3-x64/Xeno.exe

    • Size

      140KB

    • MD5

      f0d6a8ef8299c5f15732a011d90b0be1

    • SHA1

      5d2e6cc0bd4f1e810808f2a284f6c2a30b21edcf

    • SHA256

      326bae0bd1398234dcef4c3d71f00e30cc9b447fa963e21d6f29605f42bb7e5b

    • SHA512

      5b9f1517949a7fa9fdb7413146632d21a4208dc92823b673af85963ae5cc7f827b3ba27f3e9c5554c45e726ad159aac77d30306acc3559bd8712534e41ff0f27

    • SSDEEP

      3072:2hK4Uay3XrQ8habqgp9pC9Z6p5uf3C6k0xuZ04ntfxDhBury:2hK4XycqgpfCup5sVxuZ04bhA

    Score
    6/10
    discovery

    • Legitimate hosting services abused for malware hosting/C2

    behavioral11behavioral12

    • Target

      Xeno-v1.1.3-x64/XenoUI.dll

    • Size

      95KB

    • MD5

      8a0f97c09c4a713e0b2679e90ced44d4

    • SHA1

      e3e06aef78b52e7b764d0e7d8fd906c54c90048c

    • SHA256

      1f041667be5eba5def7efb76d50b9ee4c4988fb8f1e6a1758710b8f73104ba3a

    • SHA512

      06534538d6ba8d8bc8f2528a5bccb8675ee6e65c2f3d79321388c926f926387bdc59b9f247a79f73b804954b2aafeb49b6b53f703bab0a73e573f201ebe5a22d

    • SSDEEP

      1536:ySFCPbkPlSfMuaf1qWR42zxMVY6dTPr7Wa5iiZhOuM/APHV5y6SlSW8fXR:NFWWytdTPr7WAbh7Pby6S+fXR

    Score
    1/10
    behavioral13behavioral14

    • Target

      Xeno-v1.1.3-x64/api-ms-win-crt-convert-l1-1-0.dll

    • Size

      15KB

    • MD5

      c8dbf0ca88facfe87899168a7f7db52c

    • SHA1

      e2cf163ad067b5d3b19908a71ed393711f66cd09

    • SHA256

      94b6e91b93c2202dabd659bff294bee87c22897a30a6b4930b49051c2fb502dc

    • SHA512

      e85c738f5d5a0ae6c3ef75a082712cb3cf2feae4560d316cb110e4eaf3a97d6058d5374da2a5edde39c3114f9aff8a027cbdff8cf49be2425943bac09c39e70b

    • SSDEEP

      192:w89M0wd8dc9cy1WphWWD1S8f4DBQABJt9o0Z5uE7Mqnajcno:wt0wd8xy1WphWWD1IDBRJtO0zuOMlAo

    Score
    1/10
    behavioral15

    • Target

      Xeno-v1.1.3-x64/api-ms-win-crt-filesystem-l1-1-0.dll

    • Size

      13KB

    • MD5

      42a2a95f1bb940d01f55eb1674a81fe2

    • SHA1

      f982f3bbb4dc3aaaba8df098d1b395846f7cba08

    • SHA256

      51541ec6684b43157a85ea46a42ebed4555be06bed0d0d07ff3ea6377301318d

    • SHA512

      de9a7a1a6a45e2f76105eaeafcc3c29adbff142dcf2586e147417045b897a9dcddec5e1b97acfc5d3fc9c8e3a508dbc3f607bf3df20a7435e74436f94cb056b6

    • SSDEEP

      192:zt/PGnWlC0i5C9WphWAeD1S8f4DBQABJJ2yy2D8KN3qnajV2MVorr:VunWm5C9WphWbD1IDBRJJkt2lxnorr

    Score
    1/10
    behavioral16

    • Target

      Xeno-v1.1.3-x64/api-ms-win-crt-heap-l1-1-0.dll

    • Size

      12KB

    • MD5

      98da186fd7d7873c164a51c5d7b77f1a

    • SHA1

      725a8b8fdfbe6a1e85674f4b2a7c0dd08411e00b

    • SHA256

      80139e4caa379d87b1d1dafc23ace71d2b330368115f6314140d4ae59c2a78e8

    • SHA512

      587b49a24cc59d4dcb62b59f379d1c9010196a6551cfc99ffdd931eeb0172618f020863191e530d65ad198e57063c57ba6f70bcf80591304243268ea5513f806

    • SSDEEP

      192:DaY17aFBRQWphWp+QD1S8f4DBQABJtAa46ArNc4qnajr7PQW:7VWphWFD1IDBRJtAa54lrPQW

    Score
    1/10
    behavioral17

    • Target

      Xeno-v1.1.3-x64/api-ms-win-crt-locale-l1-1-0.dll

    • Size

      11KB

    • MD5

      ff48b107b2449a647c64baabd49408a1

    • SHA1

      efb868ba125d9ff08474f02b9483d74c36a13cee

    • SHA256

      7bb8644e565ad4bcfd890f9044bccb4d99953a740e9a500b1f820b2fdc3fc240

    • SHA512

      4da2e4b727e7f31f8bffd680453c451b444bdf217c15cb36e353f8bb5ecb6c6481caa7d848558c7d94cfc2d1bc3551ace11e85ffc8ec7a7b570a59c294ea0216

    • SSDEEP

      192:JWphWzDD1S8f4DBQABJtySO5M8xOSqnaj3yAY9:JWphWHD1IDBRJtyICTluAY9

    Score
    1/10
    behavioral18

    • Target

      Xeno-v1.1.3-x64/api-ms-win-crt-math-l1-1-0.dll

    • Size

      20KB

    • MD5

      e10e077bb06209aedd0d0d378c758f73

    • SHA1

      97a9053a311280678f8ef65dc4e25975c41bd4ee

    • SHA256

      8a7bff1c918539a75c25568db25933d653c003e016fd7791a37186b42bbb7c20

    • SHA512

      571c1fc4192320bd967b603e6cda917a62f4720eb4dcd557ec2913d2558c0cfe68f936198f5809934aaa3a1d6049e8e918eb0e638a7244df5c71ef0c78843191

    • SSDEEP

      384:rJI2M4Oe59Ckb1hgmLZWphW1D1IDBRJJo95DKlxT1xpN:ri2Mq59Bb1jEkI1PU5Dmv

    Score
    1/10
    behavioral19

    • Target

      Xeno-v1.1.3-x64/api-ms-win-crt-runtime-l1-1-0.dll

    • Size

      16KB

    • MD5

      f91e1ff896b5616919ac97c7095c513e

    • SHA1

      4ec6eed0bac5a8801db10238c7b3a5d35a87be67

    • SHA256

      07382c0d91dad2bb6ba8bd06ea02f12c57abf7c4e5a70672e9f2954d09a4ffd4

    • SHA512

      6448d6cdfde11e1805b6d381111ea062f681807c9dc54ae890305f287b13b6fb57ef3f4d3b909e56b81c99830c086b5702b46ba0f93e695fce2b87b32fa4b26a

    • SSDEEP

      192:uaajPrpJhhf4AN5/KipWphWAzD1S8f4DBQABJJLQ67T0q11qnajVtPx5g:ulbr7fWphWiD1IDBRJJL7Tplxb5g

    Score
    1/10
    behavioral20

    • Target

      Xeno-v1.1.3-x64/api-ms-win-crt-stdio-l1-1-0.dll

    • Size

      17KB

    • MD5

      429c26ed27a026442f89c95ff16ce8c2

    • SHA1

      69ed09faae00a980c296546c9b5e6a8d5f978439

    • SHA256

      2a466648affd3d51b944f563bb65046a3da91006a0d90fb2c0b123487a1fc1b3

    • SHA512

      04641164d9e1eb3183db0c406583626011dfe2b2574551c0ac466ebf44165afcd7d8faf356b8268b4fc9a54db20de010a4e4293594ad2e605950aea65636f4e5

    • SSDEEP

      192:BpPLNPjFuWYFxEpah7WphWRD1S8f4DBQABJ+SiLuEbNEdiqnajVCpEbOg4:B19OFVh7WphWRD1IDBRJ5iLbnlxkEf

    Score
    1/10
    behavioral21

    • Target

      Xeno-v1.1.3-x64/api-ms-win-crt-string-l1-1-0.dll

    • Size

      18KB

    • MD5

      0f593e50be4715aa8e1f6eb39434edd5

    • SHA1

      1117709f577278717c34365ce879bcd7c956069b

    • SHA256

      bf4ea10be1b64c442ac0ccf4bdf69f6703467176a27e9e14a488d26448a6e179

    • SHA512

      487dcbf7b7f18d62606cb2f05c8feff07e6ecda42e643f5919c6edda66cdb3b8cc393b0d260374f06c10cf54082410fc9f02bd87cc50866bc0c28b0bcec3e658

    • SSDEEP

      384:fFvU4x0C5yguNvZ5VQgx3SbwA7yMVIkFGl3WphW+D1IDBRJ5YBMOnlxkEx:p5yguNvZ5VQgx3SbwA71IkFxVI1PKJ

    Score
    1/10
    behavioral22

    • Target

      Xeno-v1.1.3-x64/bin/Monaco/index.html

    • Size

      164KB

    • MD5

      001dcbb8f41cdcbf9b4d1e3a0ed4b2d2

    • SHA1

      982a05814546017c40771e59e7677b53d84787e9

    • SHA256

      f1d2c52f2803c29585b81d2eff74c56242d27e9619ee6d38081d5604c5bb1951

    • SHA512

      9a4eba2a9314b6f5851997e1db0ecfae8e40da3443d8a5f9df933ccf6a4d75fc330888c8d14818326e15b3dec9ae2f5f7e73cd08c3822dd7eb0b2d753c8cd8fa

    • SSDEEP

      3072:Nk4J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pblM:64J09BA3pZaFD48VOAGUWYPjdlLJbRBS

    Score
    6/10
    discovery

    • Legitimate hosting services abused for malware hosting/C2

    behavioral23behavioral24

    • Target

      Xeno-v1.1.3-x64/bin/Monaco/vs/base/worker/workerMain.js

    • Size

      133KB

    • MD5

      d0ac5294c58e523cddf25bc6d785fa48

    • SHA1

      1b3661b6db36f1b14fd80dc9a739bfc69c68dfe5

    • SHA256

      e90d1a8f116fa74431117a3ad78dde16dde060a4bf7528dfe3d5a3ad6156504b

    • SHA512

      fea07a1ea5d29a3b4c614248655f4d1ddd94c10c6a6b5c8b428a8b4c0cbec7e7492fa0665c5001e65ce167240ffdfc5ac2c2ed14da3d6f508ae8d8b3c8e8eebb

    • SSDEEP

      3072:bzjH/zYJc5c/7tMLrJ78II4F9N8+em5W+:XjH/zYJc5c/76LrJ78I7BL

    Score
    3/10
    execution
    behavioral25behavioral26

    • Target

      Xeno-v1.1.3-x64/bin/Monaco/vs/basic-languages/lua/lua.js

    • Size

      4KB

    • MD5

      eebda1fdd970433750c115eae2f03865

    • SHA1

      3f1a1cddb99dead013eac825eb418241656d4bf0

    • SHA256

      ac729efb3164f48d6b08f74d4b15060c126a30d40fb4cd4fc9cc94f2e19bd7c7

    • SHA512

      8b188f3ae73a14a9318dce9761312d9dd2360ab00ee36e83ca6b74288a109c91770954db7537fd84a76707a1e79528fffc97f3a718bcd924545b469a1363c9cb

    • SSDEEP

      96:HDGAW6FJJJkCO8evcIWtdrvrg+1/sLMiWAOKjLobLMzD:BWCDqC20IWtZD92pzOKvomD

    Score
    3/10
    execution
    behavioral27behavioral28

    • Target

      Xeno-v1.1.3-x64/bin/Monaco/vs/editor/editor.main.js

    • Size

      2.1MB

    • MD5

      2dc0068cdbc03ce43a75ab0b2df664e2

    • SHA1

      817a209e179466dc8a14e05eb11a6c1b7e3d71eb

    • SHA256

      b604b6148f70fe9db882cce2a7d327b2422ad2f203a805491002a8c564e3c3ff

    • SHA512

      1ce29ed21e027d3552dc05162250bd62d66555f7b9ff48c9c94116d1e696089c32851533e7db30a7507a85b598df8fbf66292904c446536ccd3b2c60209d9d3d

    • SSDEEP

      24576:jFFExk98EXl2uRJxjP3Ddv6QLtQ2MbRpn:Yxk98EXl2ixjP3Ddv6QLtdMf

    Score
    3/10
    execution
    behavioral29behavioral30

    • Target

      Xeno-v1.1.3-x64/bin/Monaco/vs/editor/editor.main.nls.de.js

    • Size

      46KB

    • MD5

      d1fd2fb756c73970b9c5e0ba07bff708

    • SHA1

      470057b3244886dccc9f6074297cc8bc2a9c1b39

    • SHA256

      cb1c3416ff242a738c45c3b2590d7d222b159a95a69ce3b7b8d7c8d18ea70828

    • SHA512

      db2432182ff4c85fcca5093d0e433ed9cf5bed3ea3db9ed82fedc87af4d260e0d0f29ff67f0b8ac78e162586a74998ad082a91e8f9a76717827a83d5b2f775cf

    • SSDEEP

      768:ocuLC1xYdRB1a3Xq1GdigBoQqAaI/QQUEYPxFpXT1kF7bJZYmz7lehjDWMQRBk3Z:oclxgVuXq1GdiRQqAaI/QvEYPxFpDkbg

    Score
    3/10
    execution
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

discovery
Score
3/10

behavioral12

Score
6/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

discovery
Score
6/10

behavioral24

discovery
Score
6/10

behavioral25

execution
Score
3/10

behavioral26

execution
Score
3/10

behavioral27

execution
Score
3/10

behavioral28

execution
Score
3/10

behavioral29

execution
Score
3/10

behavioral30

execution
Score
3/10

behavioral31

execution
Score
3/10

behavioral32

execution
Score
3/10