Overview

overview

10

Static

static

9

Release.zip

windows11-21h2-x64

1

Release/Xe....5.exe

windows11-21h2-x64

10

Release/au...in.dll

windows11-21h2-x64

3

Release/au...al.dll

windows11-21h2-x64

3

Release/au...ts.dll

windows11-21h2-x64

3

Release/lo...ng.dll

windows11-21h2-x64

1

Release/lo...ng.dll

windows11-21h2-x64

1

Release/lo...ng.dll

windows11-21h2-x64

1

Release/lo...er.dll

windows11-21h2-x64

1

Release/lo...-1.dll

windows11-21h2-x64

1

Release/ru...er.dll

windows11-21h2-x64

1

Release/ru...er.dll

windows11-21h2-x64

1

Release/ru...er.dll

windows11-21h2-x64

3

Release/sc...Dex.js

windows11-21h2-x64

3

Release/scripts/IY.js

windows11-21h2-x64

3

Release/sc...eld.js

windows11-21h2-x64

3

Release/sc...eck.js

windows11-21h2-x64

3

Release/sc...Env.js

windows11-21h2-x64

3

Release/wo...re.dll

windows11-21h2-x64

1

Release/wo...pet.js

windows11-21h2-x64

3

Microsoft....re.dll

windows11-21h2-x64

1

adblock_snippet.js

windows11-21h2-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Release.zip

  • Size

    54.9MB

  • Sample

    250309-yj6a3szsbx

  • MD5

    36f6f243db51246df6a1a3fe2532c7e9

  • SHA1

    01b10d6dff00c3ac0e1a7621c9de81196e0e73e2

  • SHA256

    6017e85e18e58338af9869f75a211548f3b91aabfac91078c45d81258d4a99ca

  • SHA512

    10bc62f8d90dbb0acfd407ed76fe6fdfb287d8ca6a131d611f23aafbce46d56ab6015ba11172bea943030c1fcef650bff752cf33a98b560b8d6129af88797e7b

  • SSDEEP

    1572864:4+Zv81W+Zv81x+Zv81il3+F5PsQQ0aMm8b2y:4+Zv81W+Zv81x+Zv813FNsQQQ36y

Score
10/10
cryptonediscoveryexecutionpacker

Malware Config

Targets

    • Target

      Release.zip

    • Size

      54.9MB

    • MD5

      36f6f243db51246df6a1a3fe2532c7e9

    • SHA1

      01b10d6dff00c3ac0e1a7621c9de81196e0e73e2

    • SHA256

      6017e85e18e58338af9869f75a211548f3b91aabfac91078c45d81258d4a99ca

    • SHA512

      10bc62f8d90dbb0acfd407ed76fe6fdfb287d8ca6a131d611f23aafbce46d56ab6015ba11172bea943030c1fcef650bff752cf33a98b560b8d6129af88797e7b

    • SSDEEP

      1572864:4+Zv81W+Zv81x+Zv81il3+F5PsQQ0aMm8b2y:4+Zv81W+Zv81x+Zv813FNsQQQ36y

    Score
    1/10
    behavioral1

    • Target

      Release/Xeno-v1.1.5.exe

    • Size

      13.6MB

    • MD5

      3510a102e154a87509366fa7211d6531

    • SHA1

      0809c1343d410230283807ff33ed12e15f5083bb

    • SHA256

      2a8eb94c85ef55e617a8729cf816a621a0b5435c3d21c0c256691925f73306fa

    • SHA512

      e2eaa40c5680bc1df5cb53df05387066051e0ab5ae6ffe5d7bc75c8f99c8852cbb591ee9855e1b8fe649540b39f2caa544f0136f3edf2e96edc17cf7a2512358

    • SSDEEP

      393216:qpw8+Wp9JxBF8jWzgzdY4HdNI49JxBF8jWzgzdB:q68+Wp9jBF8jMt49W49jBF8jMs

    Score
    10/10
    discovery

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Suspicious use of SetThreadContext

    behavioral2

    • Target

      Release/autoexec/bin

    • Size

      18.7MB

    • MD5

      88fd7dbf04bcf75123d02009aea3f7f7

    • SHA1

      cecf16bdad71e54afc941179ea2b7438a04efa1d

    • SHA256

      01481b9a862936fbc090bda4033f22d7ffa5a7bfe5dc32f47c7794332b34eec4

    • SHA512

      2c6298b5adf91b51f0042d48e0846f5b196d52a588fd4fc577bf19ec26ad8e547382279a15f8bf131b08b0d7c140534aff25f82d5e8998818b812e72c9493917

    • SSDEEP

      393216:hqA/D2IIyzg8DolBo6i0KoI6Di42sC1/syU3DXNs6hq8:hqcaZyV0fC1JOpjhq8

    Score
    3/10
    discovery
    behavioral3

    • Target

      Release/autoexec/local

    • Size

      18.7MB

    • MD5

      88fd7dbf04bcf75123d02009aea3f7f7

    • SHA1

      cecf16bdad71e54afc941179ea2b7438a04efa1d

    • SHA256

      01481b9a862936fbc090bda4033f22d7ffa5a7bfe5dc32f47c7794332b34eec4

    • SHA512

      2c6298b5adf91b51f0042d48e0846f5b196d52a588fd4fc577bf19ec26ad8e547382279a15f8bf131b08b0d7c140534aff25f82d5e8998818b812e72c9493917

    • SSDEEP

      393216:hqA/D2IIyzg8DolBo6i0KoI6Di42sC1/syU3DXNs6hq8:hqcaZyV0fC1JOpjhq8

    Score
    3/10
    discovery
    behavioral4

    • Target

      Release/autoexec/scripts

    • Size

      18.7MB

    • MD5

      88fd7dbf04bcf75123d02009aea3f7f7

    • SHA1

      cecf16bdad71e54afc941179ea2b7438a04efa1d

    • SHA256

      01481b9a862936fbc090bda4033f22d7ffa5a7bfe5dc32f47c7794332b34eec4

    • SHA512

      2c6298b5adf91b51f0042d48e0846f5b196d52a588fd4fc577bf19ec26ad8e547382279a15f8bf131b08b0d7c140534aff25f82d5e8998818b812e72c9493917

    • SSDEEP

      393216:hqA/D2IIyzg8DolBo6i0KoI6Di42sC1/syU3DXNs6hq8:hqcaZyV0fC1JOpjhq8

    Score
    3/10
    discovery
    behavioral5

    • Target

      Release/locales/resources/app.asar.unpacked/node_modules/btime/binding.node

    • Size

      118KB

    • MD5

      13a2579ed95366185a6247c9e4b9f0cc

    • SHA1

      61fef12da622484e44b3c9ddcd61706c9af00aa0

    • SHA256

      98c51303c38dc03faeeba13f26fa3c6645d0c1a502b8a5d28177ce015dacf35f

    • SHA512

      7aae5a45f5333355c81e4a7468d40c9d814a1b242c99a39747fea9b66e277dd1060bda290fc980e958beccab2ac0232fc4aba078426ac5ae39c19968ae8f58d0

    • SSDEEP

      1536:OMwHUFyUCyB7KdX2teZOpSPtvdO+tYLZI2mAq+J6sWyd09dlgh7tBrdO6t2:hwjUCyB7eC8OpSS+tYLZI5+NMKFdO6t

    Score
    1/10
    behavioral6

    • Target

      Release/locales/resources/app.asar.unpacked/node_modules/get-fonts/binding.node

    • Size

      125KB

    • MD5

      eeb1d1ea9fc3f870f292161cfa79850d

    • SHA1

      ea4f4324245f9f4d6280ef285151f688221d6023

    • SHA256

      149bc3824ecbf68f7a892a311e77548ea156963b88db0590063b50725c9d883c

    • SHA512

      795269fba2737ca51d61bb0f6e674c8ed45f2590a48d1dbc53adae9a85b5565e372de6e2a888f038660173f6f4fe0ecda293c441415296e79097c261c452f254

    • SSDEEP

      3072:cd5+N3E2MosoJCakr0dHPAMMMtrAfz9MrRAG:yIxMQQakr0xPSfzirqG

    Score
    1/10
    behavioral7

    • Target

      Release/locales/resources/app.asar.unpacked/node_modules/vibrancy-win/binding.node

    • Size

      118KB

    • MD5

      6c12c930f974e5bc7872b58964f42359

    • SHA1

      805c5c899c32535d2ee8b2bc12deefe5fdaae566

    • SHA256

      094bfeb0692885f1e56bb363e1065099eab48a7988c8603fd6a3fb49ec88b09c

    • SHA512

      f46c416e3f33e0526c2d4cb3df738f7c9b11fece350b90ca9613e5d86bae7a363dd20b80d62f5745a9d51773b655199537b09fcf47acf226f35002f39f1596d3

    • SSDEEP

      3072:/WKjx2yp1tLqA1HB4kdeRqGmX5EMMi6leGS:3xBPVf1HB4kER4UFhS

    Score
    1/10
    behavioral8

    • Target

      Release/locales/resources/vk_swiftshader.dll

    • Size

      4.8MB

    • MD5

      98cd947cb91f60c944b46c612ba732b1

    • SHA1

      6b4de1cd559ceeee8781c19e84a68a8759cff9d3

    • SHA256

      fdb59038b414deaaa96bf0744abd7a7d4fb36fd59bb2c3b36f71e5a2cc9c8d82

    • SHA512

      a262deb3683c93492bfb2467c539cdf8df5f684d49c4c78770ebfc62ae8a949f6b9a18497d377d62cd5231d0eca9994c6b5e7b0885ffed787bcff1ad41669999

    • SSDEEP

      49152:eveyoM/h2BPSjPJEvoSNxxJanAf9dX2kcngUkomWPG2pu6n9MT5F9AZCeqx7l1Zx:cQM/agZaHt7A4P//

    Score
    1/10
    behavioral9

    • Target

      Release/locales/resources/vulkan-1.dll

    • Size

      880KB

    • MD5

      0971bc5ea027dba6fb7e0e39713c9b64

    • SHA1

      fef070d731e910131ce4474e4b22b123749de3c7

    • SHA256

      c7d946d9585a856abe6201e2ddb128e6dd2a376950c375e5d09a4f1f0f0ad792

    • SHA512

      03e7bf839720b37a69b1e87779f552609a6df73913ecbb3a1baa8a814902ff563ba2a55eb95811a368d02cd93fa1d5a0d657ffbce9f8609474d4d7a6b6936db3

    • SSDEEP

      12288:mefVW1lX8MvG9E0wsYox2Nmp6yWEaAT6bJUQzH3To+4AEir1iSozbz:mOcTX8p20wsYHmXaATmXjvFozbz

    Score
    1/10
    behavioral10

    • Target

      Release/runtimes/win-arm64/native/WebView2Loader.dll

    • Size

      132KB

    • MD5

      6945039d194214317f9bbdc40c57ef8c

    • SHA1

      15d08817c393deff51d4ce44741e5a6984783e2b

    • SHA256

      02db1c3c3f5606769393199136148679b2334d16d5afb7ed4ef4654d7316edf4

    • SHA512

      a300aa9698523bca861bbb1c00f9b256c97baa50510650165edd4c845c37a27ab1c687ae7f52a13eaebde8212fb159f07a505dc22f1bb315bc5e4eb8756da14e

    • SSDEEP

      3072:1MASjt+Wsz3AGsMj+y5TWhEtNEOKbmCj6:kt+Ws3iEt6OK6D

    Score
    1/10
    behavioral11

    • Target

      Release/runtimes/win-x64/native/WebView2Loader.dll

    • Size

      156KB

    • MD5

      b1cc3d7d194abc6908801cd0334a6c70

    • SHA1

      5f3c72eafab090095a08f17f026415cbfefa8349

    • SHA256

      1b23ff90ac64223bcb21b14a107079c7bb4ad0697ed841a0c0485c7d0fe0a175

    • SHA512

      ed351fe2efe92df52ba79f4239297ea20f8f4a061c413d81f35b29bc8b5db95500c4f5a631439a0abc1d5753b616297fa69aa04ee96f807f78cc0c3f69d9c85d

    • SSDEEP

      3072:qKLKQDEW3JHtcGNd/SzCzkYLSq9hX4qSd/8SALTUYrEtnWldxP2HK:NTBt9Nd/9d18qSGEtmx

    Score
    1/10
    behavioral12

    • Target

      Release/runtimes/win-x86/native/WebView2Loader.dll

    • Size

      112KB

    • MD5

      d0b3cc3feef9a483b63d180ccdc1992a

    • SHA1

      812388ee2b1bca8946203979c3f4c427aef22c1f

    • SHA256

      fc14dc275026daba48c4014a0de0f4e228043fa899c9ae0308f6ea2c239af1f1

    • SHA512

      2185b810fd90d812035543efbadd684c12f835e7dcfb949324daa5954950674aea621280a8f408e17deae8f01b2c19b6dce64238f2843e30a1dfcb8e449a980a

    • SSDEEP

      3072:nsaDUh9T2dO9O3ed9zJ11Xx3QKHwsTPOEt+AlL0F3Hd:nsp9T2dO4o91MEt7h839

    Score
    3/10
    discovery
    behavioral13

    • Target

      Release/scripts/Dex.lua

    • Size

      410KB

    • MD5

      e37374a8aa47cf8ac6d56901436e199f

    • SHA1

      5d62f5db07614f3b548702faa4f7a06e235c9b12

    • SHA256

      47cc5f1102fda0eba76b9570a1b943326f2170f270d5280e1f8dd5723c43fc14

    • SHA512

      efee19e8109a48d49f099dd1767c722935123c4ea4d6e0ab905703e16fcb7196d31c45826d4398a5b7249e686ca90db3f671416909ce3440d4709edf1bd55775

    • SSDEEP

      6144:X+B5OQiY5mqWM4Kg9HHj/B7TjmmDLmogQcEZVTkJuMap1PBPY9ZSnJm7xoiZDDHQ:RQ90qWM4Kg9HHj/B7TjHKi

    Score
    3/10
    execution
    behavioral14

    • Target

      Release/scripts/IY.txt

    • Size

      480KB

    • MD5

      69f23c9d75e7e51707aa64473b0e5642

    • SHA1

      7e6d5eed5d792d0882c828d31965f26dc740588f

    • SHA256

      efe338a26980378a7dcda54989425934cedf3b5db0df82f1e02f8c82d7003337

    • SHA512

      5847ff81c9e3028710d944a69b66dda42bd71f8b512ddd6afd4942648e1185c6f045673de6299416633c8ee36446585fdf9c6bde286a35e39a22028681d5fa97

    • SSDEEP

      6144:nkrLcE7j0LtUWRhp2HRFY91IBWQulO7tFo5n4XO9wDhoQhGZtUi8/1JVr4U48usx:nkrLcE9WrUbYoFOn4Xr+po

    Score
    3/10
    execution
    behavioral15

    • Target

      Release/scripts/Infinite Yield.lua

    • Size

      464KB

    • MD5

      b7fd97a54c618754ceab75e8a5c2de10

    • SHA1

      feb96643a76f785177fa4e841b92e6a0af364180

    • SHA256

      784f1c6ac0d4a3abdce59e09b0e9b52da6c426136cf0bfd775445e8194b77ddc

    • SHA512

      078f305142e6b2d3300d249ba305897374e0d5a78e6db9ac902370b1eee433ee83322568735b3d82706fd1fc117dcbd3fe60ad5c2d8cada8deb36b2de6da7921

    • SSDEEP

      6144:OkrLwE7/2eTtOWGhzWtRNY9gIBuQulO7oFo5n4Xd9wDhoQhGZtUi8/1j304U48uH:OkrLwE4WG6NYQFOn4Xyipo

    Score
    3/10
    execution
    behavioral16

    • Target

      Release/scripts/UNC Check.txt

    • Size

      28KB

    • MD5

      b76726d10354343d9af5c268e40b47c4

    • SHA1

      7103c78071be0c65c8b3a217168cf7909aef748e

    • SHA256

      e8d53406c916b8e827c65c8f00d8a18b1379e693fd0379e8116e749bdf860cf5

    • SHA512

      5caffd8a06058e890fe4ae35430539281cf53fa791221189f0f6660778a83fa42cc3e5374ce06ff325420d92006c2bfe1003f1486714e889964075da66b046eb

    • SSDEEP

      768:JopEYRzOKMrGrE7BWf9r+T+f9TkIuP4hUUsbU8FqQFBF5UXzRFEe3cSG5Sg/i5rx:JEKcZuy9p

    Score
    3/10
    execution
    behavioral17

    • Target

      Release/scripts/UNCCheckEnv.lua

    • Size

      28KB

    • MD5

      b76726d10354343d9af5c268e40b47c4

    • SHA1

      7103c78071be0c65c8b3a217168cf7909aef748e

    • SHA256

      e8d53406c916b8e827c65c8f00d8a18b1379e693fd0379e8116e749bdf860cf5

    • SHA512

      5caffd8a06058e890fe4ae35430539281cf53fa791221189f0f6660778a83fa42cc3e5374ce06ff325420d92006c2bfe1003f1486714e889964075da66b046eb

    • SSDEEP

      768:JopEYRzOKMrGrE7BWf9r+T+f9TkIuP4hUUsbU8FqQFBF5UXzRFEe3cSG5Sg/i5rx:JEKcZuy9p

    Score
    3/10
    execution
    behavioral18

    • Target

      Release/workspace/Xeno.exe.WebView2/EBWebView/Speech Recognition/1.15.0.1/Microsoft.CognitiveServices.Speech.core.dll

    • Size

      2.6MB

    • MD5

      0ee2b50c85a110689352fccfa77b5b18

    • SHA1

      d9ecc4b12d2d50e3cbce40e75edad804c9988b25

    • SHA256

      62a13d8459e0992c311dc3551bf3c2d1ce167ea7fa40f0ec62193f3bd760b36e

    • SHA512

      a4f94a05a69b5ae3a0ecf8bdb7592f698d0df81e2f1fae679f38890ad04a2384883837bc792c73848955ff4af7afed49d38839f7ab174454e61919ed78655bff

    • SSDEEP

      49152:NodIJ85qaIU7ui8DDR5s8L0Oty8CvFqwsNcrCY2/YUZzQ7L9qhV6O8mOn0k10:gEDRwrcAwDl

    Score
    1/10
    behavioral19

    • Target

      Release/workspace/Xeno.exe.WebView2/EBWebView/Subresource Filter/Unindexed Rules/10.34.0.57/adblock_snippet.js

    • Size

      2KB

    • MD5

      f5c93c471485f4b9ab45260518c30267

    • SHA1

      ee6e09fb23b6f3f402e409a2272521fdd7ad89ed

    • SHA256

      9aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690

    • SHA512

      e50a1baf20db9bc867e85ab72f9976430e87d8516ca552f9342a5c91822c9e1404e4f915042d48d841cca3fb16fd969bf0aa01195791ce29de63c45814fcdcda

    Score
    3/10
    execution
    behavioral20

    • Target

      Microsoft.CognitiveServices.Speech.core.dll

    • Size

      2.6MB

    • MD5

      0ee2b50c85a110689352fccfa77b5b18

    • SHA1

      d9ecc4b12d2d50e3cbce40e75edad804c9988b25

    • SHA256

      62a13d8459e0992c311dc3551bf3c2d1ce167ea7fa40f0ec62193f3bd760b36e

    • SHA512

      a4f94a05a69b5ae3a0ecf8bdb7592f698d0df81e2f1fae679f38890ad04a2384883837bc792c73848955ff4af7afed49d38839f7ab174454e61919ed78655bff

    • SSDEEP

      49152:NodIJ85qaIU7ui8DDR5s8L0Oty8CvFqwsNcrCY2/YUZzQ7L9qhV6O8mOn0k10:gEDRwrcAwDl

    Score
    1/10
    behavioral21

    • Target

      adblock_snippet.js

    • Size

      2KB

    • MD5

      f5c93c471485f4b9ab45260518c30267

    • SHA1

      ee6e09fb23b6f3f402e409a2272521fdd7ad89ed

    • SHA256

      9aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690

    • SHA512

      e50a1baf20db9bc867e85ab72f9976430e87d8516ca552f9342a5c91822c9e1404e4f915042d48d841cca3fb16fd969bf0aa01195791ce29de63c45814fcdcda

    Score
    3/10
    execution
    behavioral22

MITRE ATT&CK Enterprise v15

Tasks