7f11780a831ca44d0ea08edb8143ed75da85cb0986441142cd941e8fcc807074

Target
Xeno-v1.2.50U.zip
Size 6.1MB
Sample250830-x468faykv2
SHA256 7f11780a831ca44d0ea08edb8143ed75da85cb0986441142cd941e8fcc807074
MD5 477753799d102bcd84b9bbc6c2182c19
SHA1 ecf595c7e09f9542e5d2da5f30663bc3bae6c10f
SHA512 18f78d14c8785e172a74df88de7f3abaa3dc60b94e463dea9962b3906fd421612439033e1513d32f423568ad63e395df645777b4b7139566a148a7a67180ee9f
SSDEEP 196608:AFSrG0C0ktpbg3/zTKB5n4sWKHbOP28VgvjJHpxL+U4Rd3:AF+G0C0C2PfKB54szbb8VgRpxSU4H
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Targets

- Target
  Xeno-v1.2.50U/Microsoft.Web.WebView2.Core.dll
- Size 557KB
- SHA256 11e88b2ca921e5c88f64567f11bd83cbc396c10365d40972f3359fcc7965d197
- MD5 b037ca44fd19b8eedb6d5b9de3e48469
- SHA1 1f328389c62cf673b3de97e1869c139d2543494e
- SHA512 fa89ab3347fd57486cf3064ad164574f70e2c2b77c382785479bfd5ab50caa0881de3c2763a0932feac2faaf09479ef699a04ba202866dc7e92640246ba9598b
- SSDEEP 12288:6CxswUBor35JrpQ322zy+uFKcDoRFNCMmeA+imQ269pRFZNIEJdIEY0lxEIPrEIE:6Cbmv
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  Xeno-v1.2.50U/Microsoft.Web.WebView2.WinForms.dll
- Size 37KB
- SHA256 5696366f7458da940cc986dc5d3d4549a2368512acd769014ecbb07b47bd88b4
- MD5 8153423918c8cbf54b44acec01f1d6c2
- SHA1 f0c3c5412b809725e6d4809230adb15cc7d83ad2
- SHA512 f3dc771e37c71479d332142ec5a9c5c3f39ca71937f595a0f7482ae5aaaafd92e932efc9b0363d4511d547f3c8b2e0497ebbf8356e7d07fc344f4e5715b0ee87
- SSDEEP 768:1sjCEEHJ9l0EeFZ2sxIHzttZDgcEST3p4Jjrjh2jJ+SG2au8vxJKia5/Zi/ZGQKk:wCEB15azttZDgcEST3p4JjrjaJ+SG2a/
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  Xeno-v1.2.50U/Microsoft.Web.WebView2.Wpf.dll
- Size 50KB
- SHA256 b628d6133bf57b7482a49aa158e45b078df73ee7d33137ac1336d24ac67ed1b4
- MD5 4a292c5c2abf1aab91dee8eecafe0ab6
- SHA1 369e788108e5fb0608a803fa2e5a06690b4464b5
- SHA512 ca22adfff9789730e4c02343e320d80b8466cfc5a15f662cefe376b7ee29dea571004c1c26cd3f50c0d24e646f2b36b53fa86835678f46f335d65eec52431cde
- SSDEEP 1536:gpGhWMhWLF9jwKi8LDP/ryEH0GBy4JjrD1aah/UaOzk6hKKa5/Bi/IGCv0Z0T6Cc:taBi8LDP/b0GBy4JjrD1aah/UaOzk6hz
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  Xeno-v1.2.50U/Newtonsoft.Json.dll
- Size 695KB
- SHA256 22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07
- MD5 adf3e3eecde20b7c9661e9c47106a14a
- SHA1 f3130f7fd4b414b5aec04eb87ed800eb84dd2154
- SHA512 6a644bfd4544950ed2d39190393b716c8314f551488380ec8bd35b5062aa143342dfd145e92e3b6b81e80285cac108d201b6bbd160cb768dc002c49f4c603c0b
- SSDEEP 12288:mFIM0KteTMN4Or4D3OdmZg5WHEaEDIGBBjgrIQtD+tVqDMW:6zMTMNNd+g5Wk78GBBjgrIQtDF
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  Xeno-v1.2.50U/WebView2Loader.dll
- Size 161KB
- SHA256 465a7ddfb3a0da4c3965daf2ad6ac7548513f42329b58aebc337311c10ea0a6f
- MD5 c5f0c46e91f354c58ecec864614157d7
- SHA1 cb6f85c0b716b4fc3810deb3eb9053beb07e803c
- SHA512 287756078aa08130907bd8601b957e9e006cef9f5c6765df25cfaa64ddd0fff7d92ffa11f10a00a4028687f3220efda8c64008dbcf205bedae5da296e3896e91
- SSDEEP 3072:7evoTTlTRTyiuPThTNTKm81SbbMYSPLNsknZiZ2HZ5AaliiT88FEtJ57dXSvlCW:HTlTRTyiuPThTNTKmFQdhsknZiMHfEti
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral9
- Target
  Xeno-v1.2.50U/Xeno.dll
- Size 1.9MB
- SHA256 9978255b38efb4b7c6c21ada0415168f912b15eb226fc5635e044387eecc6076
- MD5 34d21cd4bbeb7738960c94a9c48b0982
- SHA1 a7117e489ad48091c01590a5c380982024fcec42
- SHA512 9a69299510708ac369466b893b336c2ef4fe9493015fccb8b886cfe16bcbc0a84e75ee89c14b80beae3c9339c4a01a801b1b52928340f2deee0e13e964a16111
- SSDEEP 24576:nNypRncO74kjqnv/RHi+8oPpn2r8cs1fM9upcMJpsq1JaCo5KWNDU05UlfMp2GW/:nspNqkjqN+oPpn2r8c62RXMWFH+RE987
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral11
- Target
  Xeno-v1.2.50U/Xeno.exe
- Size 158KB
- SHA256 6a3b57a082691d904b1f3598e4e461efc65339e7dd4766a261c6352d561d6d19
- MD5 5bbed58ec0d6a4dc1639e3e65eee740a
- SHA1 eb5f36b01252d409069a84498e87ca307efe1041
- SHA512 4b4ee4d62e077785b58ef08b60e3f9d898f4cabfc72018ff274484436dbdcb56afdc0c7d9a3e398f035d8f1820d4e4ad679a515bc505cdfc8cb38edb68b358e4
- SSDEEP 3072:1Lp44Gswj7UR3eO17GUlhoVUtCBlAh5XWFTK7tcVV7:1Lp44j3eO1aYtYY5mFTK7wV7
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral12 behavioral13
- Target
  Xeno-v1.2.50U/XenoUI.dll
- Size 130KB
- SHA256 dbc74acba90caf395531a09fc8322ebac464fd5b424cf6f9354445a26880c39b
- MD5 999da42366b1d7545b5abfb148f124b9
- SHA1 b26e1616ce84da05e49277313f1c2e44015699bf
- SHA512 631ea123d8a5017303d23848b2e116681eb5e4e3e273c0a0df34a116b966fcaf694f47e5dfd95d6a596138e5ebc5ec2835f4fd27dc61d004e8ee26468ffa2a29
- SSDEEP 3072:8w8VstPBNTNIEyJ7Pby6SgV9Sj0LC55dVPOdXmdJ:F8VGPBNBIptby6p9Sj0Uh2dW
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral14 behavioral15
- Target
  Xeno-v1.2.50U/api-ms-win-crt-convert-l1-1-0.dll
- Size 15KB
- SHA256 94b6e91b93c2202dabd659bff294bee87c22897a30a6b4930b49051c2fb502dc
- MD5 c8dbf0ca88facfe87899168a7f7db52c
- SHA1 e2cf163ad067b5d3b19908a71ed393711f66cd09
- SHA512 e85c738f5d5a0ae6c3ef75a082712cb3cf2feae4560d316cb110e4eaf3a97d6058d5374da2a5edde39c3114f9aff8a027cbdff8cf49be2425943bac09c39e70b
- SSDEEP 192:w89M0wd8dc9cy1WphWWD1S8f4DBQABJt9o0Z5uE7Mqnajcno:wt0wd8xy1WphWWD1IDBRJtO0zuOMlAo
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral16
- Target
  Xeno-v1.2.50U/api-ms-win-crt-filesystem-l1-1-0.dll
- Size 13KB
- SHA256 51541ec6684b43157a85ea46a42ebed4555be06bed0d0d07ff3ea6377301318d
- MD5 42a2a95f1bb940d01f55eb1674a81fe2
- SHA1 f982f3bbb4dc3aaaba8df098d1b395846f7cba08
- SHA512 de9a7a1a6a45e2f76105eaeafcc3c29adbff142dcf2586e147417045b897a9dcddec5e1b97acfc5d3fc9c8e3a508dbc3f607bf3df20a7435e74436f94cb056b6
- SSDEEP 192:zt/PGnWlC0i5C9WphWAeD1S8f4DBQABJJ2yy2D8KN3qnajV2MVorr:VunWm5C9WphWbD1IDBRJJkt2lxnorr
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17
- Target
  Xeno-v1.2.50U/api-ms-win-crt-heap-l1-1-0.dll
- Size 12KB
- SHA256 80139e4caa379d87b1d1dafc23ace71d2b330368115f6314140d4ae59c2a78e8
- MD5 98da186fd7d7873c164a51c5d7b77f1a
- SHA1 725a8b8fdfbe6a1e85674f4b2a7c0dd08411e00b
- SHA512 587b49a24cc59d4dcb62b59f379d1c9010196a6551cfc99ffdd931eeb0172618f020863191e530d65ad198e57063c57ba6f70bcf80591304243268ea5513f806
- SSDEEP 192:DaY17aFBRQWphWp+QD1S8f4DBQABJtAa46ArNc4qnajr7PQW:7VWphWFD1IDBRJtAa54lrPQW
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral18
- Target
  Xeno-v1.2.50U/api-ms-win-crt-locale-l1-1-0.dll
- Size 11KB
- SHA256 7bb8644e565ad4bcfd890f9044bccb4d99953a740e9a500b1f820b2fdc3fc240
- MD5 ff48b107b2449a647c64baabd49408a1
- SHA1 efb868ba125d9ff08474f02b9483d74c36a13cee
- SHA512 4da2e4b727e7f31f8bffd680453c451b444bdf217c15cb36e353f8bb5ecb6c6481caa7d848558c7d94cfc2d1bc3551ace11e85ffc8ec7a7b570a59c294ea0216
- SSDEEP 192:JWphWzDD1S8f4DBQABJtySO5M8xOSqnaj3yAY9:JWphWHD1IDBRJtyICTluAY9
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19
- Target
  Xeno-v1.2.50U/api-ms-win-crt-math-l1-1-0.dll
- Size 20KB
- SHA256 8a7bff1c918539a75c25568db25933d653c003e016fd7791a37186b42bbb7c20
- MD5 e10e077bb06209aedd0d0d378c758f73
- SHA1 97a9053a311280678f8ef65dc4e25975c41bd4ee
- SHA512 571c1fc4192320bd967b603e6cda917a62f4720eb4dcd557ec2913d2558c0cfe68f936198f5809934aaa3a1d6049e8e918eb0e638a7244df5c71ef0c78843191
- SSDEEP 384:rJI2M4Oe59Ckb1hgmLZWphW1D1IDBRJJo95DKlxT1xpN:ri2Mq59Bb1jEkI1PU5Dmv
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral20
- Target
  Xeno-v1.2.50U/api-ms-win-crt-runtime-l1-1-0.dll
- Size 16KB
- SHA256 07382c0d91dad2bb6ba8bd06ea02f12c57abf7c4e5a70672e9f2954d09a4ffd4
- MD5 f91e1ff896b5616919ac97c7095c513e
- SHA1 4ec6eed0bac5a8801db10238c7b3a5d35a87be67
- SHA512 6448d6cdfde11e1805b6d381111ea062f681807c9dc54ae890305f287b13b6fb57ef3f4d3b909e56b81c99830c086b5702b46ba0f93e695fce2b87b32fa4b26a
- SSDEEP 192:uaajPrpJhhf4AN5/KipWphWAzD1S8f4DBQABJJLQ67T0q11qnajVtPx5g:ulbr7fWphWiD1IDBRJJL7Tplxb5g
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21
- Target
  Xeno-v1.2.50U/api-ms-win-crt-stdio-l1-1-0.dll
- Size 17KB
- SHA256 2a466648affd3d51b944f563bb65046a3da91006a0d90fb2c0b123487a1fc1b3
- MD5 429c26ed27a026442f89c95ff16ce8c2
- SHA1 69ed09faae00a980c296546c9b5e6a8d5f978439
- SHA512 04641164d9e1eb3183db0c406583626011dfe2b2574551c0ac466ebf44165afcd7d8faf356b8268b4fc9a54db20de010a4e4293594ad2e605950aea65636f4e5
- SSDEEP 192:BpPLNPjFuWYFxEpah7WphWRD1S8f4DBQABJ+SiLuEbNEdiqnajVCpEbOg4:B19OFVh7WphWRD1IDBRJ5iLbnlxkEf
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral22
- Target
  Xeno-v1.2.50U/api-ms-win-crt-string-l1-1-0.dll
- Size 18KB
- SHA256 bf4ea10be1b64c442ac0ccf4bdf69f6703467176a27e9e14a488d26448a6e179
- MD5 0f593e50be4715aa8e1f6eb39434edd5
- SHA1 1117709f577278717c34365ce879bcd7c956069b
- SHA512 487dcbf7b7f18d62606cb2f05c8feff07e6ecda42e643f5919c6edda66cdb3b8cc393b0d260374f06c10cf54082410fc9f02bd87cc50866bc0c28b0bcec3e658
- SSDEEP 384:fFvU4x0C5yguNvZ5VQgx3SbwA7yMVIkFGl3WphW+D1IDBRJ5YBMOnlxkEx:p5yguNvZ5VQgx3SbwA71IkFxVI1PKJ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23
- Target
  Xeno-v1.2.50U/concrt140.dll
- Size 316KB
- SHA256 2405355f0a58067b258f8df33c327e3a3d716eaac5a3a5aebb757842d85bd376
- MD5 5fe9a647921ded8a2fad92deb9ec4ab2
- SHA1 1ce87fac4c22aae82a81ddb26952c074b744e78d
- SHA512 11fe4c0519cb1df73695ce38b5fdea2a563de565116a47ff0032d5a68b8c51fe732ad66738a7167e56d79193c60af9204a7ee0beae8ff8bb75abd0b484c2d764
- SSDEEP 6144:jfjSd54rw5k9cZW1Cbfpri5/ww8VRj7nWzg/p8Wcz:DOP4rwK9c0ILqzocz
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral24 behavioral25
- Target
  Xeno-v1.2.50U/editor/index.html
- Size 164KB
- SHA256 0d03c9a51da2081234fa6ea2dc18ab4f9b2dec7e586ec2c45605bc4cd6d26794
- MD5 3a36935e8e71276a25c205a4f1120544
- SHA1 7f6b01775d81fce68860cd015e8397db376e1099
- SHA512 f80fa673094db2d7776a381d48b6cbbff9dbfd5c9e134c0f716ea349ec863115940c721ac4b20b4f167754d0c81c39e1994148a394c2424886e9c84057c3d3db
- SSDEEP 3072:Nk4J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pblb:64J09BA3pZaFD48VOAGUWYPjdlLJbRBZ
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

discovery
- Legitimate hosting services abused for malware hosting/C2
behavioral26 behavioral27
- Target
  Xeno-v1.2.50U/editor/vs/base/worker/workerMain.js
- Size 133KB
- SHA256 e90d1a8f116fa74431117a3ad78dde16dde060a4bf7528dfe3d5a3ad6156504b
- MD5 d0ac5294c58e523cddf25bc6d785fa48
- SHA1 1b3661b6db36f1b14fd80dc9a739bfc69c68dfe5
- SHA512 fea07a1ea5d29a3b4c614248655f4d1ddd94c10c6a6b5c8b428a8b4c0cbec7e7492fa0665c5001e65ce167240ffdfc5ac2c2ed14da3d6f508ae8d8b3c8e8eebb
- SSDEEP 3072:bzjH/zYJc5c/7tMLrJ78II4F9N8+em5W+:XjH/zYJc5c/76LrJ78I7BL
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral28 behavioral29
- Target
  Xeno-v1.2.50U/editor/vs/basic-languages/lua/lua.js
- Size 4KB
- SHA256 ac729efb3164f48d6b08f74d4b15060c126a30d40fb4cd4fc9cc94f2e19bd7c7
- MD5 eebda1fdd970433750c115eae2f03865
- SHA1 3f1a1cddb99dead013eac825eb418241656d4bf0
- SHA512 8b188f3ae73a14a9318dce9761312d9dd2360ab00ee36e83ca6b74288a109c91770954db7537fd84a76707a1e79528fffc97f3a718bcd924545b469a1363c9cb
- SSDEEP 96:HDGAW6FJJJkCO8evcIWtdrvrg+1/sLMiWAOKjLobLMzD:BWCDqC20IWtZD92pzOKvomD
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral30 behavioral31
- Target
  Xeno-v1.2.50U/editor/vs/editor/editor.main.js
- Size 2.1MB
- SHA256 b604b6148f70fe9db882cce2a7d327b2422ad2f203a805491002a8c564e3c3ff
- MD5 2dc0068cdbc03ce43a75ab0b2df664e2
- SHA1 817a209e179466dc8a14e05eb11a6c1b7e3d71eb
- SHA512 1ce29ed21e027d3552dc05162250bd62d66555f7b9ff48c9c94116d1e696089c32851533e7db30a7507a85b598df8fbf66292904c446536ccd3b2c60209d9d3d
- SSDEEP 24576:jFFExk98EXl2uRJxjP3Ddv6QLtQ2MbRpn:Yxk98EXl2ixjP3Ddv6QLtdMf
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Checks whether UAC is enabled

Legitimate hosting services abused for malware hosting/C2

Network Share Discovery

Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32