50d805e32213ae99fa2a9ca15e4107cad60bb54f74bd4b65723777a54e378379

Sharing

Copy URL Twitter E-mail

General

Target
Xerin-v4.0.1.2-Cracked-main.zip
Size 9.9MB
Sample260419-enppcact2j
SHA256 50d805e32213ae99fa2a9ca15e4107cad60bb54f74bd4b65723777a54e378379
MD5 b24152c782e3f4c4520b595c5cc0cb8f
SHA1 38eae0beea9de09f5feb909a96db281b70f38166
SHA512 7e5cdfcb5e1ae3b9da713b8090420cfa30192d13fabeb74558422065d57c54d8674ed28b619ed2dfa1e3ef938876741002494af36e221388ab3ad360386459f5
SSDEEP 196608:GcftkSIPfqxmtXcgQcKvv2WkZQfUM2dCx8vyPn3kHh8CDC9An14baGU:blkSwyxEfpWZZx8QA8sC9Anoa7
TLSH
T101A63374344FF8FE85D88A696362384F661BD9666321D61CB2500E885CD0DD3BCBE36E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

agilenet discovery

Malware Config

Targets

- Target
  Xerin-v4.0.1.2-Cracked-main.zip
- Size 9.9MB
- SHA256 50d805e32213ae99fa2a9ca15e4107cad60bb54f74bd4b65723777a54e378379
- MD5 b24152c782e3f4c4520b595c5cc0cb8f
- SHA1 38eae0beea9de09f5feb909a96db281b70f38166
- SHA512 7e5cdfcb5e1ae3b9da713b8090420cfa30192d13fabeb74558422065d57c54d8674ed28b619ed2dfa1e3ef938876741002494af36e221388ab3ad360386459f5
- SSDEEP 196608:GcftkSIPfqxmtXcgQcKvv2WkZQfUM2dCx8vyPn3kHh8CDC9An14baGU:blkSwyxEfpWZZx8QA8sC9Anoa7
- TLSH
  T101A63374344FF8FE85D88A696362384F661BD9666321D61CB2500E885CD0DD3BCBE36E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Xerin-v4.0.1.2-Cracked-main/Config/Processes list.ini
- Size 2KB
- SHA256 0a192466ea90673475a8d9278cd583d3f281c35e46956c48b0b9671be849f8aa
- MD5 35d6b5c8c609a3a2f2ee516a85b36650
- SHA1 95a958d93c67a8b486cff465c2bb02c1134262d3
- SHA512 9e0dd862aaa0a786039ef9aa54ea8285c76aacfef8358a86c0af801c19d15bfb3b873d12e06c3fca47a7a14ebacc0834333d05bf1543351db0daf8557e49e278
- TLSH
  T1B34165B29789706603FE3E5AD3756130B08F02874E6036759AC7DB58268B5F45B686B0
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  Xerin-v4.0.1.2-Cracked-main/Guna.UI2.dll
- Size 2.1MB
- SHA256 538e6ca6001d609e251f88243409a2cbc9bc0517751843e76485a2c335e7829b
- MD5 278752062981db6fe27ba55f5099b8ae
- SHA1 8446637986cf4a24e9135ee5c54f3170600e1e83
- SHA512 142ff82ca90ca63a6a854e866615d742b585c102e8c4de5c773edeb1ac30c2cc2f6bcb190da394e4aadb4ef9518d194d99904463d6e952170d2924b16fcb00a5
- SSDEEP 49152:PQNztBO2+VN7N3HtnPhx70ZO4+CPXOn5PThDH2TBeHjvjiBckFjvkoEFB:PAhck1
- TLSH
  T196A5F9153DD4EE27C16ECE3796E35011E2F1A4933AB2EB0E62D35768184274978873BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Xerin-v4.0.1.2-Cracked-main/Newtonsoft.Json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH
  T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Xerin-v4.0.1.2-Cracked-main/README.md
- Size 261B
- SHA256 c3555fbda88d6dc9478b4327ed75f1c462d1c675bcac3d544045f4a09c61b0a5
- MD5 667e87ad7288073d5c5a5feeefabcf71
- SHA1 84da60a196e148afbe904730f70c76f9e710b0f2
- SHA512 449acbafb8795d2e94653cc521a34dddb682d4ebe4462f23060960611efdd7ba974bea3a7cb8126ecf5f79f78deda42e27046f4ff5b708c363464830c79df497
- TLSH
  T141D02B1379CD492E461D9554098722D4B76AC6BD073A411A9A07407E01058158E1D49A
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  Xerin-v4.0.1.2-Cracked-main/Ressy.dll
- Size 129KB
- SHA256 3974229973a2216ff24fd14cb045f1b3ffd1f2f147291797441a5504400c4463
- MD5 d4d917fc4fa0e0aa1d2c1d3f3c06e128
- SHA1 4c1ecd42a75bfb0a625f1f465a9da18863392b75
- SHA512 2f4e92b74cd3a0389cd15ddba51417bb84ff4438f62fcad3ef38fff3daf7eb5de384885cdcdeb915061c3355d83bc89262a71a51ea9b5c1cb6daf84649ef8a9e
- SSDEEP 3072:AuMV3QTvgGrGDl5Hc+0LgdwX9GkfcrbPc0NOOSnpl:aVbl58TLvOiOSnp
- TLSH
  T1A2D3AE1C63AD4B27C7EECE3AB0A841421B71E1069537F72F8D9CB0ED2A4379909502F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Xerin-v4.0.1.2-Cracked-main/Terminator.dll
- Size 350KB
- SHA256 b1a2d9414dd02d38f59a0d1a834a268ba346fba1e4b67b2955ec1ba62950f0d8
- MD5 c75d1feffcf5a0703fdbbcc1f066966c
- SHA1 a9556778b6b7deaf37f1b6cba8e5a151c289acf7
- SHA512 89bc326b1c7f14902f12438c7b2edccac80039a8ba8209acbd2ba332bf371e17747b25ff421875275a0b3f833853aea40d9acdd9caa4f41623930cd8d34d0630
- SSDEEP 6144:ANSkLNy8oskKUAox9o5ZzVCMe36bsXTa7uycigl4tWrSfBX:Szy8onAWoL1e7e+lliBX
- TLSH
  T12E749D0CB2E2CF60D2EB963099B7101923F6A65272E7FB5D3A5C0371AC833ED55992D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Xerin-v4.0.1.2-Cracked-main/XVM.Core.dll
- Size 1.4MB
- SHA256 edd6518a2cee258b01ff850a1a3d39c774f8f6d7ec24de49f89ffcc10cd55181
- MD5 20b7c99c378be1b10b0880d16a827d79
- SHA1 96d9feb87a130fc957b22395c03daecfe94dd6f8
- SHA512 0944bf90587928cffcc89ba8bf0df8f2501fad22e4afe81c77600dc65e88902b30b802a0a1c79ead45ae6c49bf1c5f4ef707c1530dafd03a34ec02261fad43eb
- SSDEEP 24576:ciN4P+uCL2k1niIYw2ZO3pBCuYbtnrasIFpe3QGbsfz+KKLlBr:VukYw2ZcpcuQtnGsskQGbkzKLlB
- TLSH
  T163659D84E3E11F27CA6C3B73C5352C94E7F7E60535ABF34C76B78521B9422A892925C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Xerin-v4.0.1.2-Cracked-main/XVM.Runtime.dll
- Size 101KB
- SHA256 fdbe113d0e49d917d3b11201e5032e480c302416d928a98090ed3d121ea35ecc
- MD5 90f48f496e1c36f7c5d938d0619f1b9a
- SHA1 7953583df11398ae3dced8da756082ce45190e07
- SHA512 6d04e38733def1661c99d51295d3988fa411853e1f8353a92d1484789696592cba9a65a18e99013df8e40dc87e04c92ba950d2d1cf7e4054a9011ed4730957e2
- SSDEEP 1536:IzX8M05JuIJGyAIlBIqu1mysIdtYbSo0lamo0/9NYchTf/o:ID8LvGyAITAqKYb4o0/9NYCT3o
- TLSH
  T19CA3B43E8DB06E61C9DC41BC98473E1887ADA34259CED3A62EC070F67E533931576A83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Xerin-v4.0.1.2-Cracked-main/Xerin.Auth.dll
- Size 492KB
- SHA256 6a816d36011d569bdae458b339738950d26351d6057d2ab8799bc638691c0acd
- MD5 41ddcfb6d126ec5f21637f8d7ac1b03d
- SHA1 7f3a036eb9e57425bec07472774795f0e53b0222
- SHA512 90a8a6b973555e09b245e94c0dfda6ad6fc0d8d8522643817152ae3cc9d783208f764bacd62ee2c9bf63fe96fa6efa045381780b7f78018a594e18288662f46f
- SSDEEP 12288:tGusTgfYI3WDrIxtpqwZp6YnombwjeeJqIs7qGi:tGufvGqqwnxnomxeJ
- TLSH
  T18BB4E0297BDD9E92E9DD87FD9061019097B2BD11F24BF3C6285D5FF42A833A0D90128B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Xerin-v4.0.1.2-Cracked-main/Xerin.CLI.exe
- Size 424KB
- SHA256 b280b10565b3ffe9f61540e6e899c7aabd70198339251f389222330b34a6695a
- MD5 eb24cfc9c05f097c5e6d30a2e9263880
- SHA1 e09a64e0337bd4aad8cd170d68adbd07f90fa367
- SHA512 a880e1848b8feb7e1f4e2a38cc6e4739c44da289b2326f02df187c53c93a32bc398539fc45c5e150b42f748028aeba1980a6bed2de1bdab1532357616b33dcc6
- SSDEEP 12288:NbzNqjoICFGXllPOamyoj8rPjvyubnwUjQSsUqgao:N9+ZX/GMojY2wvjQwao
- TLSH
  T15194D029BADFCB52C6CD0379A18204909FB1A516F28BEFDB706956F82F433518E5134B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

agilenet discovery
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral21 behavioral22
- Target
  Xerin-v4.0.1.2-Cracked-main/Xerin.Core.dll
- Size 725KB
- SHA256 591eea96d01bf41fbd828624936b64cb1cecf0ee0fc63d62d5be3a3b41f9be68
- MD5 212d007908ff6dc4a0a19ff8616aa48f
- SHA1 3ce0930fb201a12c0c58a6214e52656a01425481
- SHA512 ba618d11986632d7e00e979bc295edb1b55697d5981b20d8ae2da67ca9c5345cb66534fa11c64508ab9445841e61154886a4264720d9d90f81d07f5b0fca4993
- SSDEEP 12288:2j2p/x3+Am6XVRwjJvxPugcbSdz16U1x413dMhoeUH/sY1tpL7:2j2p/9UTtJPRiSVoL13Cc/sY1Ln
- TLSH
  T120F48D02E5FACF65E1CF1D71A1B255000BB3B75455E3EB283BB0A9763C193E45AB22E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Xerin-v4.0.1.2-Cracked-main/Xerin.Loader.dll
- Size 120KB
- SHA256 f5e623d8bf3d55c77b003468017d28c8c81618a184e660b5ac2e5c4d0b296e01
- MD5 a4177da367f122fd007c3c63d878b384
- SHA1 61a53132f4d3aef74c72a98b74d9b6ee1c0158c1
- SHA512 e9aa68100a65f5120e070476826c81702b783c3d00af471b10db061a7524f2c823e386131bc731bcc2b9681843b2162f8198020e1c6c2d942c20734203045c8b
- SSDEEP 3072:86vY6ut9qY++MhI2AFIRbqldPTYXzzQT6:7+/qYMOZCzQ
- TLSH
  T1C4C34A39BA9C9597C38E2374E4D113E2C2F2A9127647D1EBAC195DE63E633E54C0720B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Xerin-v4.0.1.2-Cracked-main/Xerin.Protections.dll
- Size 2.4MB
- SHA256 fe2d18fcc65a94c347f2b62ac3d11a84c31158193862c95927f5453384545b7a
- MD5 b9c471d2182213c3166dfc590b62ac47
- SHA1 55d58427e4484d96c0d84c0306083b310c551f56
- SHA512 bbe8813888976b4bd17d0dede384b3dbe113cae0fe4e544d332ab92fdf9a8aa95d70d4d6d8e5903e2d900fe201198fa2d52eb0b1d15037bc5ae638e8635b9e98
- SSDEEP 49152:dwy6lbDLArBGJ8pwReJd5IcO9LJHszEw2wfX5eT+h2/+bfOhcXza:ubDLAwRe9OnHszGwfXCn/+bGG
- TLSH
  T16FB50213A9FC8F06D4C41636D4762064C7B277CA3527FB1E2AB6426EE4133A5CDE6389
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Xerin-v4.0.1.2-Cracked-main/Xerin.Runtime.dll
- Size 40KB
- SHA256 30d9f6d3c398eea0e6a101e511705989b7f4aad4171ad5418232baa1a740687b
- MD5 e3b5c3b2fcf599f7e1e9cbfc925dd4d6
- SHA1 b20e72015c8c7cb477e487bf73c0157aeab4e14b
- SHA512 d0f689f16c51676368f2c62586d5c78a65e74f1ab2605d43d47810fd035900eb968da770cd6ac0ede1856681c6deb2bf1e50fee358b5f80cf573a600a4b8695d
- SSDEEP 768:cnFoAjlEXMX1nZ0qlV8TN3lmSy1xnw4SEj+bAltLXBM8dngN8KAo:hiEXMdZ0EON1e1xnwDDbAl1fdg2K1
- TLSH
  T1BA033B85BBE89A60C1BD66B748B721100377E1531A32F61F1DCDE8AD2F737845618BE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Xerin-v4.0.1.2-Cracked-main/XerinFuscator G3.exe
- Size 5.9MB
- SHA256 4d0c46035922e6a99271fffb9bc617753bcdfdcf9a0a3c8348c707f7881bf70b
- MD5 799c5f5ac22990187f99f034b47bd29c
- SHA1 3bdac40fc039f3c1e18c997a9e2c089f9adc50e7
- SHA512 f523d493aaf3e0d72217544bc77b9c5b9154599d3e6c8a8258d6e27b10218144970bcce6b64c7416fdf581f709ebb0442dd802ae2f947a01c24dff9991fd4679
- SSDEEP 98304:SCx/KAk8WZxtJr3nmXSARoPmyC0EaJEa0Ea/EaWmEa:SkKUWZtn6RhyC05J505/5D5
- TLSH
  T1B1563918351CCC8BEB380975C8D7E309D5399CE0AD5A85C2DBE834E57EF6A6CAC4186D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Obfuscated with Agile.Net obfuscator

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32