Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Xeno-v1.1.3-x64.rar

  • Size

    14.2MB

  • MD5

    33c462d92c1fd50b190c7e1a9bf81b83

  • SHA1

    2b10cb847946fa1a44bbdf26da10003574ce8f01

  • SHA256

    ad23e27a15e3d2451162bdfa17c56a26e4ee9c8892ab6964275d9dedbdff84b5

  • SHA512

    75212f758ebac8405465b4a98c3559f0f9f546929925eca52c43af9137db5077ec785caa3b36ee1ec6d5fbc94c1f6a36b9feaf427baa065e6b9b95706640f24a

  • SSDEEP

    393216:DaGqi2oTzgVZMgXtLNm0+0DS1psZ6QMqMGpq3/Lv:7qN6gQg9LNhFm164QM/Gpq3/Lv

Score
10/10

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:5552

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
  • Detects Pyinstaller 1 IoCs
  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

Files

  • Xeno-v1.1.3-x64.rar
    .rar
  • Xeno-v1.1.3-x64/Install dependencies.bat
  • Xeno-v1.1.3-x64/Microsoft.Web.WebView2.Core.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Xeno-v1.1.3-x64/Microsoft.Web.WebView2.WinForms.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Xeno-v1.1.3-x64/Microsoft.Web.WebView2.Wpf.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Xeno-v1.1.3-x64/Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Xeno-v1.1.3-x64/Xeno.dll
    .dll windows:6 windows x64 arch:x64

    044828317383e7fe51de9c1c840dc2cf


    Headers

    Imports

    Exports

    Sections

  • Xeno-v1.1.3-x64/Xeno.exe
    .exe windows:6 windows x64 arch:x64

    72c4e339b7af8ab1ed2eb3821c98713a


    Headers

    Imports

    Sections

  • Stub.pyc
  • Xeno-v1.1.3-x64/XenoUI.deps.json
  • Xeno-v1.1.3-x64/XenoUI.dll
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • Xeno-v1.1.3-x64/XenoUI.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Xeno-v1.1.3-x64/XenoUI.pdb
  • Xeno-v1.1.3-x64/XenoUI.runtimeconfig.json
  • Xeno-v1.1.3-x64/autoexec/test.txt
  • Xeno-v1.1.3-x64/bin/Monaco/index.html
    .html .js polyglot
  • Xeno-v1.1.3-x64/bin/Monaco/vs/base/worker/workerMain.js
    .js
  • Xeno-v1.1.3-x64/bin/Monaco/vs/basic-languages/lua/lua.js
  • Xeno-v1.1.3-x64/bin/Monaco/vs/editor/editor.main.css
  • Xeno-v1.1.3-x64/bin/Monaco/vs/editor/editor.main.js
    .js
  • Xeno-v1.1.3-x64/bin/Monaco/vs/editor/editor.main.nls.de.js
  • Xeno-v1.1.3-x64/bin/Monaco/vs/editor/editor.main.nls.es.js
  • Xeno-v1.1.3-x64/bin/Monaco/vs/editor/editor.main.nls.fr.js
  • Xeno-v1.1.3-x64/bin/Monaco/vs/editor/editor.main.nls.it.js
  • Xeno-v1.1.3-x64/bin/Monaco/vs/editor/editor.main.nls.ja.js
  • Xeno-v1.1.3-x64/bin/Monaco/vs/editor/editor.main.nls.js
  • Xeno-v1.1.3-x64/bin/Monaco/vs/editor/editor.main.nls.ko.js
  • Xeno-v1.1.3-x64/bin/Monaco/vs/editor/editor.main.nls.ru.js
  • Xeno-v1.1.3-x64/bin/Monaco/vs/editor/editor.main.nls.zh-cn.js
  • Xeno-v1.1.3-x64/bin/Monaco/vs/editor/editor.main.nls.zh-tw.js
  • Xeno-v1.1.3-x64/bin/Monaco/vs/loader.js
    .js
  • Xeno-v1.1.3-x64/bin/Tabs/1d0dee03-e6ef-445a-998d-88b62abc9d7c
  • Xeno-v1.1.3-x64/bin/Tabs/config.json
  • Xeno-v1.1.3-x64/bin/settings.json
  • Xeno-v1.1.3-x64/libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    945163dff22f51600d06a0b23fe994e1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Xeno-v1.1.3-x64/libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    a68e19b72bf615dc5689a862e51c72dc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Xeno-v1.1.3-x64/runtimes/win-arm64/native/WebView2Loader.dll
  • Xeno-v1.1.3-x64/runtimes/win-x64/native/WebView2Loader.dll
    .dll windows:10 windows x64 arch:x64

    f6946d311bccc86e2042a388e375de41


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Xeno-v1.1.3-x64/runtimes/win-x86/native/WebView2Loader.dll
    .dll windows:10 windows x86 arch:x86

    72229ff546c74d09d9030ca49ce61b31


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Xeno-v1.1.3-x64/scripts/Dex.lua
    .js
  • Xeno-v1.1.3-x64/scripts/Infinite Yield.lua
    .js
  • Xeno-v1.1.3-x64/scripts/Sine Wave.lua
  • Xeno-v1.1.3-x64/scripts/Spinning Donut.lua
  • Xeno-v1.1.3-x64/scripts/UNCCheckEnv.lua
    .js