Extracted

• • Target

    Xeno-v1.1.3-x64/Xeno.exe

  • Size

    10.8MB

  • MD5

    a10ae5339c94657875b5991d2b4fb0d0

  • SHA1

    6bd22c7d3e7ad538e2d8da2ea1e20257795994eb

  • SHA256

    0f669ab830e863c182ec5573e59625f76b69db6963e78c868c76e74128f86e2b

  • SHA512

    ac15657ed86595279cf2f529a917040a2687e49c953f36973c28147c95fd8d8787df008526c1d4ca5cfdb14d32c1f465242f0f552f264499b476ee3531a7e2ab

  • SSDEEP

    196608:M+AQcHKApx3ivNm1E8giq1g9mveNo+wfm/pf+xfdkR6HAxKwCr2WOHWKD3beH:6Qctn3i1m1Nqao+9/pWFGRZ0br2W673k

  Score

  10^/10

  discoveryupxexelastealercollectiondefense_evasionpersistenceprivilege_escalationspywarestealer

  • Exela Stealer

    Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.

    stealerexelastealer

  • Exelastealer family

    exelastealer

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Modifies Windows Firewall

    defense_evasion

  • Clipboard Data

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Enumerates processes with tasklist

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2

• • Target

    Xeno-v1.1.3-x64/XenoUI.dll

  • Size

    95KB

  • MD5

    0c693fdf5031de28e139121866d4e71f

  • SHA1

    d4e3f81ce0ac00efbc537b6aa4ebc07f039aaf9a

  • SHA256

    3788b42e87c69c077868856b07c03e8606e0f49389c947231701100d99337e1c

  • SHA512

    4298a579eea032e794ac4aaa2e18c793fbe0d3f33a2f8e948fde510427e604f06072b71703183c9ca88c73a805627187241f47845a9f16822243388ae5cb42af

  • SSDEEP

    1536:gOTgjZ0JbSfMuafhOWR42zxMVY6dTPr/Wa5iiphLuM/APHV5y6SlSW8zXR:bT+WytdTPr/WAbK7Pby6S+zXR

  Score

  10^/10

  xwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral3behavioral4

• • Target

    Xeno-v1.1.3-x64/XenoUI.exe

  • Size

    82KB

  • MD5

    cead4ff10b38e2da24c55582ce8602ea

  • SHA1

    efbf5d6df5a8a928d8b2a00f14c94472d5708b32

  • SHA256

    3da936a74e79a858404e820a7d0f9efd290d9299dd49a55305a865d07bd3d69a

  • SHA512

    fc599e31caad9cec48143a8d1ad8536e6af980a5b98350c44d15ae81c9eb8e7141c1e0ca3a5896f45a0322dd97794c6cbb7c6dcbbed83f1f2f79ec59ac8b7140

  • SSDEEP

    1536:IwIP5m99SZpD039LVdjMYWI7976Ob6G70ML476MrnEOstXl6daRG:IDo9wA9vjMSGOb6Gz4trEOsb6oG

  Score

  10^/10

  xwormrattrojandiscovery

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Downloads MZ/PE file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral5behavioral6