General
- Target Xeno-v1.3.55.exe
- Size 84.7MB
- Sample260619-wdd9ash18n
- SHA256 e25077ea8c75ab09abb11afc016684038ff8d09569eae31717bdce20427a2a4d
- MD5 8392a067cfdb290768f00c7e655b3f61
- SHA1 d42bb91d5c843fcca574466677099a3c7cf56c9f
- SHA512 b802152cfee15b02ccc361e7017ef5b1f8d68065db39304c23b921b89463b2de9065334ede1546b7b48e79aefb10fbb36399279d4f6de8d0dca82e1bce8586ef
- SSDEEP 1572864:ZzGmciQA+8jg7glkk9xVlYwBKE/MIJoqMyOrrfCmQPruUQAcpvl:ZzGuOIg7jCXFBKiMIJoFyOX6myMAcpvl
- TLSH T1E51833546642C698E35ACB38B094C3C3D156AFA7D9BE775028A33867F47BE440DE0D2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno-v1.3.55.exe
Resource
win10v2004-20260513-en
19 signatures
300 seconds
Behavioral task
behavioral2
Sample
Xeno-v1.3.55.exe
Resource
win10ltsc2021-20260513-en
19 signatures
300 seconds
Malware Config
Targets
-
- Target Xeno-v1.3.55.exe
- Size 84.7MB
- SHA256 e25077ea8c75ab09abb11afc016684038ff8d09569eae31717bdce20427a2a4d
- MD5 8392a067cfdb290768f00c7e655b3f61
- SHA1 d42bb91d5c843fcca574466677099a3c7cf56c9f
- SHA512 b802152cfee15b02ccc361e7017ef5b1f8d68065db39304c23b921b89463b2de9065334ede1546b7b48e79aefb10fbb36399279d4f6de8d0dca82e1bce8586ef
- SSDEEP 1572864:ZzGmciQA+8jg7glkk9xVlYwBKE/MIJoqMyOrrfCmQPruUQAcpvl:ZzGuOIg7jCXFBKiMIJoFyOX6myMAcpvl
- TLSH T1E51833546642C698E35ACB38B094C3C3D156AFA7D9BE775028A33867F47BE440DE0D2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.