General
- Target https://github.com/nass029/Xeno-Executor/releases/tag/Xeno
- Sample250408-e7z97axygt
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/nass029/Xeno-Executor/releases/tag/Xeno
Resource
win10ltsc2021-20250314-en
23 signatures
60 seconds
Malware Config
Extracted
Family
-
phemedrone
C2
-
https://api.telegram.org/bot7942123032:AAHgGmfZLCClqmUmWeGBS0R_BQn-X9hFisg/sendDocument
Targets
-
- Target https://github.com/nass029/Xeno-Executor/releases/tag/Xeno
Phemedrone family
Uses browser remote debugging
Can be used control the browser and steal sensitive information such as credentials and session cookies.
Executes dropped EXE
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
3Credentials In Files
3