General

  • Target

    Xeno-v1.1.5-x64 (2).zip

  • Size

    5.6MB

  • MD5

    21a4d9887122a4c186f7070a8eaddd43

  • SHA1

    7b28b1dbb29b108fc33ffea663916d32e437c4ec

  • SHA256

    2af9725559beb603eeab6daa046b65b8e80cbaa09c097aabb7fb774e63373268

  • SHA512

    b8cd9f571a1c25a91f31c4465307f2561a0552503ad510554363556f33c705b502b10538c31cf6743695026f9b387c5b6a9d3e186761443b793fea3ef116e224

  • SSDEEP

    98304:gFeSPA+AvJrB4oAZspCgNT1g+6/E3N4YnqflugoTnIUFnWZrBL6IxUH65Fcf:g4SY9vopZfS6/E3a1luIUlWZN6IxUHwC

Score
10/10

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.1.253:4782

Mutex

498f78ba-87f1-4d58-aef8-71c972b3dc95

Attributes
  • encryption_key

    1F41281BE3488F3C3E3F1F76C4193411000F6DBF

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
  • Quasar payload 1 IoCs
  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • Xeno-v1.1.5-x64 (2).zip
    .zip
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/Microsoft.Web.WebView2.Core.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/Microsoft.Web.WebView2.WinForms.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/Microsoft.Web.WebView2.Wpf.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/Xeno.dll
    .dll windows:6 windows x64 arch:x64

    27a311b1330c0aee48d1ddba70a324fa


    Headers

    Imports

    Exports

    Sections

  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/Xeno.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/XenoUI.deps.json
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/XenoUI.dll
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/XenoUI.runtimeconfig.json
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/api-ms-win-crt-convert-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/api-ms-win-crt-filesystem-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/api-ms-win-crt-heap-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/api-ms-win-crt-locale-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/api-ms-win-crt-math-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/api-ms-win-crt-runtime-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/api-ms-win-crt-stdio-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/api-ms-win-crt-string-l1-1-0.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/bin/Monaco/index.html
    .html .js polyglot
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/bin/Monaco/vs/base/worker/workerMain.js
    .js
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/bin/Monaco/vs/basic-languages/lua/lua.js
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/bin/Monaco/vs/editor/editor.main.css
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/bin/Monaco/vs/editor/editor.main.js
    .js
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/bin/Monaco/vs/editor/editor.main.nls.de.js
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/bin/Monaco/vs/editor/editor.main.nls.es.js
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/bin/Monaco/vs/editor/editor.main.nls.fr.js
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/bin/Monaco/vs/editor/editor.main.nls.it.js
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/bin/Monaco/vs/editor/editor.main.nls.ja.js
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/bin/Monaco/vs/editor/editor.main.nls.js
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/bin/Monaco/vs/editor/editor.main.nls.ko.js
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/bin/Monaco/vs/editor/editor.main.nls.ru.js
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/bin/Monaco/vs/editor/editor.main.nls.zh-cn.js
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/bin/Monaco/vs/editor/editor.main.nls.zh-tw.js
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/bin/Monaco/vs/loader.js
    .js
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    945163dff22f51600d06a0b23fe994e1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    a68e19b72bf615dc5689a862e51c72dc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/msvcp140.dll
    .dll windows:6 windows x86 arch:x86

    8fe8ee8466472be6c8207404ee8d1c05


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/runtimes/win-arm64/native/WebView2Loader.dll
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/runtimes/win-x64/native/WebView2Loader.dll
    .dll windows:10 windows x64 arch:x64

    f6946d311bccc86e2042a388e375de41


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/runtimes/win-x86/native/WebView2Loader.dll
    .dll windows:10 windows x86 arch:x86

    72229ff546c74d09d9030ca49ce61b31


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/scripts/Dex.lua
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/scripts/Infinite Yield.lua
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/scripts/Sine Wave.lua
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/scripts/Spinning Donut.lua
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/scripts/UNCCheckEnv.lua
    .js
  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/vcruntime140.dll
    .dll windows:6 windows x64 arch:x64

    7f91c705cf579114968b3edc12e1175e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Xeno-v1.1.4-x64/Xeno-v1.1.4-x64/vcruntime140_1.dll
    .dll windows:6 windows x64 arch:x64

    72707e942878aac770fcc118ce3ec1c9


    Code Sign

    Headers

    Imports

    Exports

    Sections