49bae1d0612ed1391834d64949b11260b9533226ac4f7f85e2ae5c0017a86f23

Sharing

Copy URL Twitter E-mail

General

Target
Xeno-v1.3.30.zip
Size 6.7MB
Sample260421-cecbjsax61
SHA256 49bae1d0612ed1391834d64949b11260b9533226ac4f7f85e2ae5c0017a86f23
MD5 85e2b8fea502bede31f11d07b77cfc12
SHA1 7e797b5008820aad652f70acf0d93f7b3415442d
SHA512 4605d6e1b7b9739688c27ceb39baa0af07c74979ec61b981af0cacc542866fd9c2f6a9adae2d734dabfb99bedf55c5904ace28c5a128cd7c57d5367452530b7b
SSDEEP 196608:S3FcHWKfGBvG7bM0V2XaCzd/so/28dgqjJx5y9cCjH:S3FaWKf/nM3h28dgQAbH
TLSH
T1B866339C9AFC04D3F5644279A9354BB93143F78267116C2BEA4C19A273DEED04683B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Xeno-v1.3.30/Microsoft.Web.WebView2.Core.dll
- Size 557KB
- SHA256 11e88b2ca921e5c88f64567f11bd83cbc396c10365d40972f3359fcc7965d197
- MD5 b037ca44fd19b8eedb6d5b9de3e48469
- SHA1 1f328389c62cf673b3de97e1869c139d2543494e
- SHA512 fa89ab3347fd57486cf3064ad164574f70e2c2b77c382785479bfd5ab50caa0881de3c2763a0932feac2faaf09479ef699a04ba202866dc7e92640246ba9598b
- SSDEEP 12288:6CxswUBor35JrpQ322zy+uFKcDoRFNCMmeA+imQ269pRFZNIEJdIEY0lxEIPrEIE:6Cbmv
- TLSH
  T15BC4402123FD8A1AE6F63BB5A57407709BFAFC967979D39D0598251C0D72B408AE0333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Xeno-v1.3.30/Microsoft.Web.WebView2.WinForms.dll
- Size 37KB
- SHA256 5696366f7458da940cc986dc5d3d4549a2368512acd769014ecbb07b47bd88b4
- MD5 8153423918c8cbf54b44acec01f1d6c2
- SHA1 f0c3c5412b809725e6d4809230adb15cc7d83ad2
- SHA512 f3dc771e37c71479d332142ec5a9c5c3f39ca71937f595a0f7482ae5aaaafd92e932efc9b0363d4511d547f3c8b2e0497ebbf8356e7d07fc344f4e5715b0ee87
- SSDEEP 768:1sjCEEHJ9l0EeFZ2sxIHzttZDgcEST3p4Jjrjh2jJ+SG2au8vxJKia5/Zi/ZGQKk:wCEB15azttZDgcEST3p4JjrjaJ+SG2a/
- TLSH
  T1B4034B0483DCC617D6EB6FB8A5B491620B7ABF837960D36D1C84F5E90DB37A0891076B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Xeno-v1.3.30/Microsoft.Web.WebView2.Wpf.dll
- Size 50KB
- SHA256 b628d6133bf57b7482a49aa158e45b078df73ee7d33137ac1336d24ac67ed1b4
- MD5 4a292c5c2abf1aab91dee8eecafe0ab6
- SHA1 369e788108e5fb0608a803fa2e5a06690b4464b5
- SHA512 ca22adfff9789730e4c02343e320d80b8466cfc5a15f662cefe376b7ee29dea571004c1c26cd3f50c0d24e646f2b36b53fa86835678f46f335d65eec52431cde
- SSDEEP 1536:gpGhWMhWLF9jwKi8LDP/ryEH0GBy4JjrD1aah/UaOzk6hKKa5/Bi/IGCv0Z0T6Cc:taBi8LDP/b0GBy4JjrD1aah/UaOzk6hz
- TLSH
  T12E33398047AD8533D6EF4FB450B481214B79BE83B9B1E78A1DC8F4E91DA77800A543AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Xeno-v1.3.30/Newtonsoft.Json.dll
- Size 695KB
- SHA256 22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07
- MD5 adf3e3eecde20b7c9661e9c47106a14a
- SHA1 f3130f7fd4b414b5aec04eb87ed800eb84dd2154
- SHA512 6a644bfd4544950ed2d39190393b716c8314f551488380ec8bd35b5062aa143342dfd145e92e3b6b81e80285cac108d201b6bbd160cb768dc002c49f4c603c0b
- SSDEEP 12288:mFIM0KteTMN4Or4D3OdmZg5WHEaEDIGBBjgrIQtD+tVqDMW:6zMTMNNd+g5Wk78GBBjgrIQtDF
- TLSH
  T165E45A2123E99B2BE0AF2775B032491647FAF542F6B7D78F5604D8AA1C43F558D82323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Xeno-v1.3.30/WebView2Loader.dll
- Size 161KB
- SHA256 465a7ddfb3a0da4c3965daf2ad6ac7548513f42329b58aebc337311c10ea0a6f
- MD5 c5f0c46e91f354c58ecec864614157d7
- SHA1 cb6f85c0b716b4fc3810deb3eb9053beb07e803c
- SHA512 287756078aa08130907bd8601b957e9e006cef9f5c6765df25cfaa64ddd0fff7d92ffa11f10a00a4028687f3220efda8c64008dbcf205bedae5da296e3896e91
- SSDEEP 3072:7evoTTlTRTyiuPThTNTKm81SbbMYSPLNsknZiZ2HZ5AaliiT88FEtJ57dXSvlCW:HTlTRTyiuPThTNTKmFQdhsknZiMHfEti
- TLSH
  T120F36C5B72E4407BE16B8274C9A34A11E77778110B60ABEF03A447791F237D4AE3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Xeno-v1.3.30/Xeno.dll
- Size 2.1MB
- SHA256 76717bae1b0eb9c1722a3eeae61195edaa827d619efd0788438a831a9369bc41
- MD5 35e60c9e5a185920c285d9829199b292
- SHA1 3f21b3528e977427f4acf5518bef34f0559ef386
- SHA512 0432e7bfc14fd6fe610d768e6b7a8a430fcd351a783552d34dabd2ed444d16803e95579c81edc2324530eb60090c8949a509e7278f3873469600076cf66b162f
- SSDEEP 49152:24303kli5j76aKsnOZ8RNcdOgjL8MBfVgHFuC3N:2vd+BCQC9
- TLSH
  T1A9A59F13A19900ECD077D1F8CA5B5A13E7727C490325B6EB12F0BA652F27AE58E3E705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Xeno-v1.3.30/Xeno.exe
- Size 160KB
- SHA256 b5ed38d64845255102a5771e5dad7c18cec210d5bf9eb094ea6ecf48add338b8
- MD5 ce6fc665575412f775d6c440cd702fd3
- SHA1 ada2c8ab8014383d88f83f12b27aa288e4ba9bf8
- SHA512 a53347b9afd1f823cdd00770b9db00cecd6f6d6b2c6dddbfa12ff23b7201029b1c768e4843e66fad8d1feeda92575ab043c3c75c7cdb987d9e976083792ad484
- SSDEEP 3072:cqvmgiYSoIk8uIHzlqRwa/YB26mDIgHBpVlq:c64k83TlEvG4IgTVo
- TLSH
  T13CF34C07A6A850BDE1B6C679C9924D41FB727C198B71A6CF07507EB60E737D0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery persistence ransomware spyware trojan
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral7
- Target
  Xeno-v1.3.30/XenoUI.dll
- Size 145KB
- SHA256 483ccf387cc140c08078904d138d59d9e1bf0cf4642897c22a14f20dee58f135
- MD5 f1a018b3f44245a316f6eb992603f274
- SHA1 9fab14f58064447659b62fda36875a44318333c2
- SHA512 079c49d2570b036e937d3780d979696f9acb4a9abf4546661960694c8ca3ac23b4d86bc3d5887c22baf7587a901f153f62084d4c622e35a289c5f12dc7dedd12
- SSDEEP 3072:tg9fjI1yw32TbyGBAOZr7Pby6SgV9Sj0LC55dVPOdXmiU6VW:Wfe32HyGRXby6p9Sj0Uh2dW8VW
- TLSH
  T158E3AF40376CCA12CABF0FBD64B152955A72BF16A5B3E70E15CC349C5CF638286523AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Xeno-v1.3.30/api-ms-win-crt-convert-l1-1-0.dll
- Size 15KB
- SHA256 94b6e91b93c2202dabd659bff294bee87c22897a30a6b4930b49051c2fb502dc
- MD5 c8dbf0ca88facfe87899168a7f7db52c
- SHA1 e2cf163ad067b5d3b19908a71ed393711f66cd09
- SHA512 e85c738f5d5a0ae6c3ef75a082712cb3cf2feae4560d316cb110e4eaf3a97d6058d5374da2a5edde39c3114f9aff8a027cbdff8cf49be2425943bac09c39e70b
- SSDEEP 192:w89M0wd8dc9cy1WphWWD1S8f4DBQABJt9o0Z5uE7Mqnajcno:wt0wd8xy1WphWWD1IDBRJtO0zuOMlAo
- TLSH
  T1A762A49366E43F15EA9F277221FEDBD72A391B81255043B8C607E54C3882782BD97C0E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Xeno-v1.3.30/api-ms-win-crt-environment-l1-1-0.dll
- Size 18KB
- SHA256 f7c6c7ea22edd2f8bd07aa5b33cbce862ef1dcdc2226eb130e0018e02ff91dc1
- MD5 c712515d052a385991d30b9c6afc767f
- SHA1 9a4818897251cacb7fe1c6fe1be3e854985186ad
- SHA512 b7d1e22a169c3869aa7c7c749925a031e8bdd94c2531c6ffe9dae3b3cd9a2ee1409ca26824c4e720be859de3d4b2af637dd60308c023b4774d47afe13284dcd2
- SSDEEP 192:sfW1hWiQcvHCjdks/nGfe4pBjSY6Na3sAW5RKTt3E2sVWQ4GWIjcyqnaj/6g6dqd:sfW1hWPQim0GftpBjzim3StltFpn
- TLSH
  T1F2822BC69ABC9543F9C3AE7052B8EA877D3DDBC31D20812605A9F5982CC73D1EB1092D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Xeno-v1.3.30/api-ms-win-crt-filesystem-l1-1-0.dll
- Size 13KB
- SHA256 51541ec6684b43157a85ea46a42ebed4555be06bed0d0d07ff3ea6377301318d
- MD5 42a2a95f1bb940d01f55eb1674a81fe2
- SHA1 f982f3bbb4dc3aaaba8df098d1b395846f7cba08
- SHA512 de9a7a1a6a45e2f76105eaeafcc3c29adbff142dcf2586e147417045b897a9dcddec5e1b97acfc5d3fc9c8e3a508dbc3f607bf3df20a7435e74436f94cb056b6
- SSDEEP 192:zt/PGnWlC0i5C9WphWAeD1S8f4DBQABJJ2yy2D8KN3qnajV2MVorr:VunWm5C9WphWbD1IDBRJJkt2lxnorr
- TLSH
  T18852F78347E47E02EAA72B3112FDDBDB3F3D5781185247668006A52839E73C1BF1659D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Xeno-v1.3.30/api-ms-win-crt-heap-l1-1-0.dll
- Size 12KB
- SHA256 80139e4caa379d87b1d1dafc23ace71d2b330368115f6314140d4ae59c2a78e8
- MD5 98da186fd7d7873c164a51c5d7b77f1a
- SHA1 725a8b8fdfbe6a1e85674f4b2a7c0dd08411e00b
- SHA512 587b49a24cc59d4dcb62b59f379d1c9010196a6551cfc99ffdd931eeb0172618f020863191e530d65ad198e57063c57ba6f70bcf80591304243268ea5513f806
- SSDEEP 192:DaY17aFBRQWphWp+QD1S8f4DBQABJtAa46ArNc4qnajr7PQW:7VWphWFD1IDBRJtAa54lrPQW
- TLSH
  T1BB421CC387B85903E7637F7026A9D68B3D3E67C66D6085668057F2A52C833C5EF0162E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  Xeno-v1.3.30/api-ms-win-crt-locale-l1-1-0.dll
- Size 11KB
- SHA256 7bb8644e565ad4bcfd890f9044bccb4d99953a740e9a500b1f820b2fdc3fc240
- MD5 ff48b107b2449a647c64baabd49408a1
- SHA1 efb868ba125d9ff08474f02b9483d74c36a13cee
- SHA512 4da2e4b727e7f31f8bffd680453c451b444bdf217c15cb36e353f8bb5ecb6c6481caa7d848558c7d94cfc2d1bc3551ace11e85ffc8ec7a7b570a59c294ea0216
- SSDEEP 192:JWphWzDD1S8f4DBQABJtySO5M8xOSqnaj3yAY9:JWphWHD1IDBRJtyICTluAY9
- TLSH
  T141422B868BB82803E6927F7006A9D6877D3E63C31811856A5087F6983C433DDEF01B6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Xeno-v1.3.30/api-ms-win-crt-math-l1-1-0.dll
- Size 20KB
- SHA256 8a7bff1c918539a75c25568db25933d653c003e016fd7791a37186b42bbb7c20
- MD5 e10e077bb06209aedd0d0d378c758f73
- SHA1 97a9053a311280678f8ef65dc4e25975c41bd4ee
- SHA512 571c1fc4192320bd967b603e6cda917a62f4720eb4dcd557ec2913d2558c0cfe68f936198f5809934aaa3a1d6049e8e918eb0e638a7244df5c71ef0c78843191
- SSDEEP 384:rJI2M4Oe59Ckb1hgmLZWphW1D1IDBRJJo95DKlxT1xpN:ri2Mq59Bb1jEkI1PU5Dmv
- TLSH
  T1F592B68749DCFF67D28F17B701F08BCE6A381AA254E1B6B4C81B918934927C47E4394D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  Xeno-v1.3.30/api-ms-win-crt-runtime-l1-1-0.dll
- Size 16KB
- SHA256 07382c0d91dad2bb6ba8bd06ea02f12c57abf7c4e5a70672e9f2954d09a4ffd4
- MD5 f91e1ff896b5616919ac97c7095c513e
- SHA1 4ec6eed0bac5a8801db10238c7b3a5d35a87be67
- SHA512 6448d6cdfde11e1805b6d381111ea062f681807c9dc54ae890305f287b13b6fb57ef3f4d3b909e56b81c99830c086b5702b46ba0f93e695fce2b87b32fa4b26a
- SSDEEP 192:uaajPrpJhhf4AN5/KipWphWAzD1S8f4DBQABJJLQ67T0q11qnajVtPx5g:ulbr7fWphWiD1IDBRJJL7Tplxb5g
- TLSH
  T1F272E7834AE87F27E68B3B7316F9D7D72A36638629104179C857E1D938C3781BD0721A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Xeno-v1.3.30/api-ms-win-crt-stdio-l1-1-0.dll
- Size 17KB
- SHA256 2a466648affd3d51b944f563bb65046a3da91006a0d90fb2c0b123487a1fc1b3
- MD5 429c26ed27a026442f89c95ff16ce8c2
- SHA1 69ed09faae00a980c296546c9b5e6a8d5f978439
- SHA512 04641164d9e1eb3183db0c406583626011dfe2b2574551c0ac466ebf44165afcd7d8faf356b8268b4fc9a54db20de010a4e4293594ad2e605950aea65636f4e5
- SSDEEP 192:BpPLNPjFuWYFxEpah7WphWRD1S8f4DBQABJ+SiLuEbNEdiqnajVCpEbOg4:B19OFVh7WphWRD1IDBRJ5iLbnlxkEf
- TLSH
  T16082C58385EC3F46D28797331AFAEBEB5635538328147278C407E9943ACA389BE0755D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  Xeno-v1.3.30/api-ms-win-crt-string-l1-1-0.dll
- Size 18KB
- SHA256 bf4ea10be1b64c442ac0ccf4bdf69f6703467176a27e9e14a488d26448a6e179
- MD5 0f593e50be4715aa8e1f6eb39434edd5
- SHA1 1117709f577278717c34365ce879bcd7c956069b
- SHA512 487dcbf7b7f18d62606cb2f05c8feff07e6ecda42e643f5919c6edda66cdb3b8cc393b0d260374f06c10cf54082410fc9f02bd87cc50866bc0c28b0bcec3e658
- SSDEEP 384:fFvU4x0C5yguNvZ5VQgx3SbwA7yMVIkFGl3WphW+D1IDBRJ5YBMOnlxkEx:p5yguNvZ5VQgx3SbwA71IkFxVI1PKJ
- TLSH
  T11982B58346F83F45CA8F57B319FAC7C72A384B4625411375C467A58C3882B96BE6BA0D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  Xeno-v1.3.30/api-ms-win-crt-time-l1-1-0.dll
- Size 13KB
- SHA256 b56bc94e8539603dd2f0fea2f25efd17966315067442507db4bffafcbc2955b0
- MD5 1d48a3189a55b632798f0e859628b0fb
- SHA1 61569a8e4f37adc353986d83efc90dc043cdc673
- SHA512 47f329102b703bfbb1ebaeb5203d1c8404a0c912019193c93d150a95bb0c5ba8dc101ac56d3283285f9f91239fc64a66a5357afe428a919b0be7194bada1f64f
- SSDEEP 192:ENDCWthWHWf9BvVVWQ4mWG5xqcVT/gqnajKsrC/V:TWthW6N/xqc1IlGsrC/V
- TLSH
  T16A52F98386E4AA0BFAC71B7112FDD7D77B3953C2298061768117D4A83A83384FE5396D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  Xeno-v1.3.30/api-ms-win-crt-utility-l1-1-0.dll
- Size 18KB
- SHA256 984306a3547be2f48483d68d0466b21dda9db4be304bedc9ffdb953c26cac5a1
- MD5 54f27114eb0fda1588362bb6b5567979
- SHA1 eaa07829d012206ac55fb1af5cc6a35f341d22be
- SHA512 18d2bdce558655f2088918241efdf9297dfe4a14a5d8d9c5be539334ae26a933b35543c9071cedada5a1bb7c2b20238e9d012e64eb5bbf24d0f6b0b726c0329d
- SSDEEP 384:RfVW1hWfFm0GftpBjaDRm3SY6vlgCohaQ:RfsQViklwHj
- TLSH
  T1E58219868EBCA583EAC36E7053E8DBC77D3D97C35D20856140AAF1982C877E1AF1461D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  Xeno-v1.3.30/concrt140.dll
- Size 316KB
- SHA256 2405355f0a58067b258f8df33c327e3a3d716eaac5a3a5aebb757842d85bd376
- MD5 5fe9a647921ded8a2fad92deb9ec4ab2
- SHA1 1ce87fac4c22aae82a81ddb26952c074b744e78d
- SHA512 11fe4c0519cb1df73695ce38b5fdea2a563de565116a47ff0032d5a68b8c51fe732ad66738a7167e56d79193c60af9204a7ee0beae8ff8bb75abd0b484c2d764
- SSDEEP 6144:jfjSd54rw5k9cZW1Cbfpri5/ww8VRj7nWzg/p8Wcz:DOP4rwK9c0ILqzocz
- TLSH
  T16C64398A76140CE6F96BE039C553851BE6F2BC416352D3CB0264839E6F637D1E93A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  Xeno-v1.3.30/editor/index.html
- Size 164KB
- SHA256 43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2
- MD5 b33eb96a570d0cdf6ded11ff199d0de3
- SHA1 47c7c58cefda42ca2a5ec53af727d34aa0663136
- SHA512 409771d5941dc934b46c3a1d906bbc352bb9c1684c4bc585d7d884acc8d8ea93661637cbf047d02b96a17ab978419f8c116097226b89898007eaf3a8e7d976a5
- SSDEEP 3072:Nk4J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pbl8:64J09BA3pZaFD48VOAGUWYPjdlLJbRBW
- TLSH
  T1E7F3F19AF1122D5226C79230619BBE297FF19490BE766B424B9CF3201091FDF116FBB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral21
- Target
  Xeno-v1.3.30/editor/vs/base/worker/workerMain.js
- Size 133KB
- SHA256 e90d1a8f116fa74431117a3ad78dde16dde060a4bf7528dfe3d5a3ad6156504b
- MD5 d0ac5294c58e523cddf25bc6d785fa48
- SHA1 1b3661b6db36f1b14fd80dc9a739bfc69c68dfe5
- SHA512 fea07a1ea5d29a3b4c614248655f4d1ddd94c10c6a6b5c8b428a8b4c0cbec7e7492fa0665c5001e65ce167240ffdfc5ac2c2ed14da3d6f508ae8d8b3c8e8eebb
- SSDEEP 3072:bzjH/zYJc5c/7tMLrJ78II4F9N8+em5W+:XjH/zYJc5c/76LrJ78I7BL
- TLSH
  T1D4D3C5CD72A5B4125397A1B1507F110FF33A296A980D44BCF365C8DD2DBA48A617BF38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22
- Target
  Xeno-v1.3.30/editor/vs/basic-languages/lua/lua.js
- Size 4KB
- SHA256 ac729efb3164f48d6b08f74d4b15060c126a30d40fb4cd4fc9cc94f2e19bd7c7
- MD5 eebda1fdd970433750c115eae2f03865
- SHA1 3f1a1cddb99dead013eac825eb418241656d4bf0
- SHA512 8b188f3ae73a14a9318dce9761312d9dd2360ab00ee36e83ca6b74288a109c91770954db7537fd84a76707a1e79528fffc97f3a718bcd924545b469a1363c9cb
- SSDEEP 96:HDGAW6FJJJkCO8evcIWtdrvrg+1/sLMiWAOKjLobLMzD:BWCDqC20IWtZD92pzOKvomD
- TLSH
  T1CEA182C6FDCCA35E8BFAF7C4CAF1E976F58DC231C02550BAFAD05508060CA89965E625
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23
- Target
  Xeno-v1.3.30/editor/vs/editor/editor.main.js
- Size 2.1MB
- SHA256 b604b6148f70fe9db882cce2a7d327b2422ad2f203a805491002a8c564e3c3ff
- MD5 2dc0068cdbc03ce43a75ab0b2df664e2
- SHA1 817a209e179466dc8a14e05eb11a6c1b7e3d71eb
- SHA512 1ce29ed21e027d3552dc05162250bd62d66555f7b9ff48c9c94116d1e696089c32851533e7db30a7507a85b598df8fbf66292904c446536ccd3b2c60209d9d3d
- SSDEEP 24576:jFFExk98EXl2uRJxjP3Ddv6QLtQ2MbRpn:Yxk98EXl2ixjP3Ddv6QLtdMf
- TLSH
  T1EAA5E6997155342243C7A0F6A4BF050BB23A546DE80A506CB3B8D8ED2CFE9496377F78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24
- Target
  Xeno-v1.3.30/editor/vs/editor/editor.main.nls.de.js
- Size 46KB
- SHA256 cb1c3416ff242a738c45c3b2590d7d222b159a95a69ce3b7b8d7c8d18ea70828
- MD5 d1fd2fb756c73970b9c5e0ba07bff708
- SHA1 470057b3244886dccc9f6074297cc8bc2a9c1b39
- SHA512 db2432182ff4c85fcca5093d0e433ed9cf5bed3ea3db9ed82fedc87af4d260e0d0f29ff67f0b8ac78e162586a74998ad082a91e8f9a76717827a83d5b2f775cf
- SSDEEP 768:ocuLC1xYdRB1a3Xq1GdigBoQqAaI/QQUEYPxFpXT1kF7bJZYmz7lehjDWMQRBk3Z:oclxgVuXq1GdiRQqAaI/QvEYPxFpDkbg
- TLSH
  T1F12308B19D46702A9FC963E0BB415D3B3A1CE2AE7A56500E4C7DC427204BAF9C6DF432
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25
- Target
  Xeno-v1.3.30/editor/vs/editor/editor.main.nls.es.js
- Size 46KB
- SHA256 327437ee3793e9ae0686c78196b459592c282ed2e86f95ce28d32693b76d7654
- MD5 36f546b28ca17ece9f8eb9bcf8344e13
- SHA1 d43934b9041587799e332b2f568aa81666227258
- SHA512 13f8cc23038c07b6840514db4fc7b503b7a38ae1ec3baab44f1bfbded40ac50ae03c05c754f9678eecd0c8fcefab958152b39b731068b8c2c976c4c57e97f36d
- SSDEEP 768:oX8nKFyVgAYwTQG8zHqIkGMvnmvoKA9OfxjB3EVuU13pjbazPn0ANy7+IkLDKPp9:oMKFyVRcdzHqIkGMvnmvoKA9OfxjB3E5
- TLSH
  T17A23A73647CC175315D302CEF2D3D513D188AC89B068C1DBA1BA9B6560CCEECD96FA6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26
- Target
  Xeno-v1.3.30/editor/vs/editor/editor.main.nls.fr.js
- Size 49KB
- SHA256 6ed837dc1905c06a20d102921ff06a0bda003c5368ed0576bf7e69494e889ae8
- MD5 1a29080733878dd44e0c118e84cd0c39
- SHA1 60c158e23962b11918f6cae26445fad5b63bc65a
- SHA512 5cc68cabb583100320d7c875fd7c46f5c618c3968ac2a7c2b60f90ec74b29349a557049c17d5c851cabb54d5ef26cd65e8d2288d70b62ede06ee1762e25dbd60
- SSDEEP 768:op8flgb2uZ5CcXQ6Q3edz3uzATaY3l0y+wj90TWIvkU5BkREPTtOjNjZocYV3A4k:owliv5Ccg67SATaYVKPkRskjNGBAa3k
- TLSH
  T1BE33A61FA6C421920DC61BC3F5625593E874C88CB39DE316ADAF53D912C68DCE2DB6E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27
- Target
  Xeno-v1.3.30/editor/vs/editor/editor.main.nls.it.js
- Size 48KB
- SHA256 4fe2c4420294758883e134bdf7da9e6c2abf631d3a89c765f32f6c1d0f62653c
- MD5 18e88f58301ad5ae926204507ab99c6b
- SHA1 8eb03235312e88b941f3be212c0efa12b24e6d5f
- SHA512 f66283ec4182e9062f9f03a83acb3f2a49b98fb9ef67e48eaf5227236919ca279831b822fcb3ae252cfeafd81d12fe9c89a2843d91ab140a2b79b6bbc1d4f013
- SSDEEP 768:opTEy7izsuMa01VaiYR2L8XoXNj8YtvnYbP4ymMb3d/gyKJdnPTrysribj5K3m05:of7fQ2qd4yq2FA1J1qn4VN7CgL
- TLSH
  T1DA23B83D0281211029DF13DEE176608EFB67A8CCBD5C716959BC052D31CEF98B19E7AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28
- Target
  Xeno-v1.3.30/editor/vs/editor/editor.main.nls.ja.js
- Size 52KB
- SHA256 1f3556ea7233843b9e08b3c97b6727c533d702563e195c2090a438070dc85f0f
- MD5 3bf851cc70f515cbbe1d39da93e4f041
- SHA1 88fe6323bbe14b55b6eec078574318e8474be613
- SHA512 61ffe9ec3550d2f8dfbc30d7d61327584833bb714a9d2cfc9788449190089dbdeaa293bb9921a43da782e1c36b7d242e13ac052b46210d2e79793626e921169d
- SSDEEP 384:hyd/PwPtm+04LZ+FFHr0ZA9qOSTvvIEveG1vz14NdahWMpA1Uj4vHbX3IPDScLBV:olP4LsIOCaT3lJr/Tvk6892vU1ssD
- TLSH
  T121336F3CA7C0A8394D2593632A9DB4EA3455AD5BEC227736C13DE021B9B03CDD185BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29
- Target
  Xeno-v1.3.30/editor/vs/editor/editor.main.nls.js
- Size 38KB
- SHA256 5ff0084e6a7eee82a735616239aaf2190ea9d90e89e19340831f3d590828016a
- MD5 e871d4d9539c26d7d2bf32801ebdecf0
- SHA1 711460f619ef09fa23d272d97bfc00593a5319a8
- SHA512 b6b9bf96c132db9dfc99d70320231630fc46a8a83f500d8e4f677e2d03206364f2666946f69061dcba2e759f005261dae1ece73e054aa56b8210551bc353cced
- SSDEEP 384:hy38McmvQkKEQq4xlX7lrp1E1bIJUeYB4jV87XfVGT3H6Sq6Q4wCJjoce1u6I7JS:o38M7fQq4xPj7+lJcYYKqkGSVetbesy
- TLSH
  T15E03FAA3A3481337298B05EBB6EEC195672A583C7711539A74EDD43821874F093BF9F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30
- Target
  Xeno-v1.3.30/editor/vs/editor/editor.main.nls.ko.js
- Size 46KB
- SHA256 98e649fa40d8e2ccfdc212341feb8165a7d7bbec31e8a77d9819ad9474e4b8ba
- MD5 60fcd422ac97a1b645ff48cb6928f7af
- SHA1 da5b57dfbd257720155e303f0e75e263f0e74190
- SHA512 52439f47f1e12ccf37db40f9fa8fa4966579cd6b327cde1768187cd7fdc7ebdd444e1953e29ed09bdced40d764c2e8f7131d44908c00bfd350e856a9df661aa4
- SSDEEP 768:oNOnmkUxK1pLkKgljQM1r0xXDj8kE6q2XlGZrAPPvzcDzr5u1QrWp4cX6go:o4ZUxKgKzxzrE63GZrAPPkrmQKp4cX6L
- TLSH
  T1482301E239DB93983547CA815AE1B6758382E5B7FB8301C0CD96CCB0CD589E7444B9BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31
- Target
  Xeno-v1.3.30/editor/vs/editor/editor.main.nls.ru.js
- Size 75KB
- SHA256 1bb069d95a395bf258d1f262814591aa762c4b30529adde32ccbcaa7c7ca508d
- MD5 6e7d5b984917b00f131c47473ce2b866
- SHA1 97f94134ff8f73ab48c0635550f2d8054c239c7f
- SHA512 f2595e7e1812073c50bfa058db3c7918dd8d7a6f0d20a576c68d854a4c61ed74bef3ad5ab23430567065677d737d81c7f17010055a069b9e38b5594d65e882a0
- SSDEEP 1536:ox/PFmMhjpIMbBBKOXnPCSHhiaV6can9oA2yG+YQI/Y:QbhjpIcB8OXdHhiXcanGA2yGiI/Y
- TLSH
  T1C57337A156DA50AE0200B50BDD087E493EEB46FE3FAB573615B43D7E34F3024C62E669
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks whether UAC is enabled

Contacts third-party web service commonly abused for C2

Network Share Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32