Behavioral task
behavioral1
Sample
Xeno-v1.1.35-x64/XenoV1.1.35.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
Xeno-v1.1.35-x64/XenoV1.1.35.exe
Resource
win10ltsc2021-20250128-en
General
-
Target
Xeno-v1.1.35-x64.zip
-
Size
32KB
-
MD5
6a28cd3be33586c3dcb2ac169003c548
-
SHA1
2277437eaaee8d0815000476c8521cf73c4d7b2d
-
SHA256
66ade287222cf2a4e9e71004621df90f588deac45c3dce68f8503cba9bdf8312
-
SHA512
c68527162b4f5174c36efb264a05cde04550707eed98d1dd16c7f8f20143475c6321f8db3b6cb9feafe357ed405ef6ba49d6b1f8616d03c404300c88d7a793be
-
SSDEEP
768:IPthRD6YRXzvK44CX4Va0fWPXsX9lrjiXYl66Bl3QB:IPxOYRXzodV+PyBKM623c
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/1333893784458494094/VsXf64MEiiSt3WDbJfN18xkRlK1PMa25-mHBLhIAisvV_VxqhXkqWyNqnIvqYoFDLSu0
Signatures
-
Mercurialgrabber family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Xeno-v1.1.35-x64/XenoV1.1.35.exe
Files
-
Xeno-v1.1.35-x64.zip.zip
-
Xeno-v1.1.35-x64/XenoV1.1.35.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ