7e1a7d00d125baa6a70594bd1c6e57c5eb919a3b265b0d3b3292d85202a53602

Sharing

Copy URL Twitter E-mail

General

Target
XenoServices-main.zip
Size 2.1MB
Sample260622-cnes2aht3w
SHA256 7e1a7d00d125baa6a70594bd1c6e57c5eb919a3b265b0d3b3292d85202a53602
MD5 b3e87a256c3aa381b5bcfbc6258184cc
SHA1 f3218e408b9bb4b0684f9815ed8877440421eb87
SHA512 da432a1379e0f3c46a5216e6e3509a07e8874ae74f664d2c3d493955d5395a0d0c5ecf6d75d45b61fe0fde47450b1fe5181f7190008c226d2af1e163dead1d80
SSDEEP 49152:KDJNKwtqEwDgwtaK4gffobEqsIxRTGDOJWtSxSNvGi5RS7:KdMgNuOsIxRGDOJGSPCRa
TLSH
T15AA5336B984B75B7C1B658F79C2D12915F7980DC83C8118D5AB7AACC2DF242CFC8922D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  XenoServices-main/Edge/index.html
- Size 1KB
- SHA256 4b10062512c0bf9531ff1a345aacebc7eb4106d11c01320195fab1261906dab3
- MD5 7948d44ccb06f8c5cadd8be19c0782a8
- SHA1 4ed12078149165d2e6f808dad15b7a15b18c206c
- SHA512 0882ed7266b0b4ec5d46532d18b45ad1e6fb47e8d498eff26f5c2614484a91c9bbe6b876a7b835b2d03f0fcde48e0dd4ee63baf7b00d320cff57ab00b016a1d6
- TLSH
  T13721403EC2C1120A80271264FB91E39826198252A2570FA1778E71ABB6CC0F756937C8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  XenoServices-main/Firefox/index.html
- Size 1KB
- SHA256 4b10062512c0bf9531ff1a345aacebc7eb4106d11c01320195fab1261906dab3
- MD5 7948d44ccb06f8c5cadd8be19c0782a8
- SHA1 4ed12078149165d2e6f808dad15b7a15b18c206c
- SHA512 0882ed7266b0b4ec5d46532d18b45ad1e6fb47e8d498eff26f5c2614484a91c9bbe6b876a7b835b2d03f0fcde48e0dd4ee63baf7b00d320cff57ab00b016a1d6
- TLSH
  T13721403EC2C1120A80271264FB91E39826198252A2570FA1778E71ABB6CC0F756937C8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  XenoServices-main/Gecko/index.html
- Size 1KB
- SHA256 4b10062512c0bf9531ff1a345aacebc7eb4106d11c01320195fab1261906dab3
- MD5 7948d44ccb06f8c5cadd8be19c0782a8
- SHA1 4ed12078149165d2e6f808dad15b7a15b18c206c
- SHA512 0882ed7266b0b4ec5d46532d18b45ad1e6fb47e8d498eff26f5c2614484a91c9bbe6b876a7b835b2d03f0fcde48e0dd4ee63baf7b00d320cff57ab00b016a1d6
- TLSH
  T13721403EC2C1120A80271264FB91E39826198252A2570FA1778E71ABB6CC0F756937C8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  XenoServices-main/Trident/index.html
- Size 1KB
- SHA256 4b10062512c0bf9531ff1a345aacebc7eb4106d11c01320195fab1261906dab3
- MD5 7948d44ccb06f8c5cadd8be19c0782a8
- SHA1 4ed12078149165d2e6f808dad15b7a15b18c206c
- SHA512 0882ed7266b0b4ec5d46532d18b45ad1e6fb47e8d498eff26f5c2614484a91c9bbe6b876a7b835b2d03f0fcde48e0dd4ee63baf7b00d320cff57ab00b016a1d6
- TLSH
  T13721403EC2C1120A80271264FB91E39826198252A2570FA1778E71ABB6CC0F756937C8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  XenoServices-main/Version/index-2.html
- Size 1KB
- SHA256 4b10062512c0bf9531ff1a345aacebc7eb4106d11c01320195fab1261906dab3
- MD5 7948d44ccb06f8c5cadd8be19c0782a8
- SHA1 4ed12078149165d2e6f808dad15b7a15b18c206c
- SHA512 0882ed7266b0b4ec5d46532d18b45ad1e6fb47e8d498eff26f5c2614484a91c9bbe6b876a7b835b2d03f0fcde48e0dd4ee63baf7b00d320cff57ab00b016a1d6
- TLSH
  T13721403EC2C1120A80271264FB91E39826198252A2570FA1778E71ABB6CC0F756937C8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral10 behavioral9
- Target
  XenoServices-main/Version/index.html
- Size 1KB
- SHA256 4b10062512c0bf9531ff1a345aacebc7eb4106d11c01320195fab1261906dab3
- MD5 7948d44ccb06f8c5cadd8be19c0782a8
- SHA1 4ed12078149165d2e6f808dad15b7a15b18c206c
- SHA512 0882ed7266b0b4ec5d46532d18b45ad1e6fb47e8d498eff26f5c2614484a91c9bbe6b876a7b835b2d03f0fcde48e0dd4ee63baf7b00d320cff57ab00b016a1d6
- TLSH
  T13721403EC2C1120A80271264FB91E39826198252A2570FA1778E71ABB6CC0F756937C8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral11 behavioral12
- Target
  XenoServices-main/assets/css/font/fontello3b7f3b7f.svg
- Size 1.0MB
- SHA256 91eaa92c60e5d249e938f2a136b9d03499c47f96d2fa5cdf045c66304f647903
- MD5 3b8effc3225e07e7c3dd920d1119a839
- SHA1 73c2a029689b4ad8bdd6e98ad3e0932a232077f7
- SHA512 28550f3c59e62ca5919bce501498904ed9263b7fa8bce86130f4b6b8f934ba5525cc82f4142584bb016422a1ec8629d0871b5ccb36770f68fb6a921ee0e9dc19
- SSDEEP 12288:7tmzGER37VVAqCuwixT2J5UsTP0lxeaUKDJlFC0JLs8hM0H7UmtaQ2BWFCm+adU:wxkqCiVz7M0JLBt4WFY
- TLSH
  T1D035D625F56424DD66AA02848ABC469C073DF2EF3229395695DCFAF0460B727EF4BDC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral13 behavioral14
- Target
  XenoServices-main/assets/css/owl.video.play.html
- Size 2KB
- SHA256 9c3fb8402916868c97de1eeb14acdb73b6d6e458112196a3b8c5d568370b3e93
- MD5 a2bbe7880811219dd1eb577001ac9477
- SHA1 28ea1afb88162bcf79b2144456b1f74998833d12
- SHA512 57b184540fb25952f36c66329ff00609678d56ad76289de84ac1e976de7bfb927f1d663819b3b5ecd679eda91b56d64ae189c605446c0f941d2721ec6eda01a7
- TLSH
  T11741B69A559B42422B11C340BBF4320582A185D7F7DEBE80B47F9079AFCDB15D851BAC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral15 behavioral16
- Target
  XenoServices-main/assets/js/circularprogress.js
- Size 4KB
- SHA256 2c2c85754d9483addaf3d128e7b28516f9ec28eb01d0c8de8d9fe6e4498e1628
- MD5 d1ab3f8f0587737748389f07150e933c
- SHA1 22d2c0d55a3ba49d5bb38093c640c2b5d0b725d1
- SHA512 af03d612565e58078d54f9cd4a0a2bdfde2e7e1383614562be338e80444524c426874977eb8f7e3b40c12788dd1235123edf358f979233f8f398c7d5ef161aaf
- SSDEEP 48:FwmWlBttGHw0p1mtw1MNIqAlfgnkdBpBk5VGbTmZfFzmfBQPoMG4DeEdPKknxqwd:Fml3cmkq2okbnieKmHQiR+
- TLSH
  T12181A7DB7292A812665765B1403F1206633328AC6927C1BC797075EE5DB4F0B21BBA7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  XenoServices-main/assets/js/headline.js
- Size 4KB
- SHA256 e5b6952969faa34a46d0dc3b96250f0e6263e74bb955d3e2327068f2ebd315fe
- MD5 df0b1c36ce37d79df29b40fd47f4f258
- SHA1 320308b73fe6b13af05f99b2901a6186ec62332c
- SHA512 cddbfd7eca4d6f6e852c4865eca89b4c7a26e8a64854cda6dbc9a675c77a76cbb72df51e3caa59474c7ff368a500a7361586b775ef4017c343c00025c20976cf
- SSDEEP 96:c86zXMDYuLKYz26/s0TsenDNqQONANYIOccVNVrArh5:c8DZz26vngbxm9
- TLSH
  T17A9103D4757029AE8EDF0EFA117E509AF53531278A85C33661F7026A0B2028E3B13DDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  XenoServices-main/assets/js/init.js
- Size 12KB
- SHA256 56bb232ee67d1edaed7512011fdbca52b050ba157489ba31a69c47634f4ff649
- MD5 a8ffc899a9312264214fa7c0474305c8
- SHA1 e2245bda015b4f608f7c34291e21e3eb41413dd1
- SHA512 7e941e8499313b922e91da484781565ab4f347bf8570294d1dd3d826854a1fd43fcdd56edf8b9f5d4fd0001e78db66cbb93aef4f775a84432b2b044b3814cae5
- SSDEEP 192:lIJL8nM63SuCJMkeIfdLSJWkLDcwIImgtZFJIE9rVV:EAWFOJWeZAO
- TLSH
  T19F52410DF5327CFF096F0EAEF0BB5368312B5494659AC807DE65C0B51FB498DA422A1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  XenoServices-main/assets/js/isotope.js
- Size 49KB
- SHA256 b44561c94e9562f1fc8f9c34af579a42567408f600adb4d612b8e921501bfe95
- MD5 9fea673bb36bdb13a31d4cb9307dac9b
- SHA1 8d3130d89e498ef4174fc676f18d2df08e3575ca
- SHA512 ac485cf04e92e3d7ac79cdfc3a7b3be27ca899f33ad6288ebc3c331d7ea69f6a8754ddbaf181046a76720db63af6448b57aa8e96605cff1cda765735d07e3730
- SSDEEP 1536:2+dt3yHQm5nM59hNc4pHXpHgrXib4uZO2p:2rHolpHXpHgbib4uZR
- TLSH
  T17033CA497784253A51CBF2EB9ABF2609723F9158C501A04CFA09E8DB2D758469137FFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  XenoServices-main/assets/js/jquery.js
- Size 87KB
- SHA256 72037311a4dfde4d042df73e31b7cbeafc0bdf2aaa605b69aff3326015a396da
- MD5 51175ac478a2eec31f39c648260a1044
- SHA1 a9ac4b258fa956d5c4918cb8781d4b20bbbd65af
- SHA512 3ac522d66dc441c53eddfc27347ae85a1fd2e77ed26750919dfc6c6937aeb2fd8defa087b6d89ca696d23d85f38baeb79b7d6d9127920b244b7348d475cd8e3e
- SSDEEP 1536:pjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1vN:pIh8GgP3hujzwbhd3XvSiDQ47GK/
- TLSH
  T1EB9309DDB2C6702257A720BA007F510BF236199D6C4D8450F169D8EABC78A4E827BF7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  XenoServices-main/assets/js/magnificpopup.js
- Size 19KB
- SHA256 378374f24b06c3530478b82bc5ea4255a9a8416306c97082fe66ce595df2b020
- MD5 6415afd95d6801025ec208d5f08300b1
- SHA1 c7a874b2dcabba0a1d324b0a5765911b058198c4
- SHA512 28baf7963797cde05c43f089bb85008d180cc259e0078acb53e99b3ac69018f3eae06cb97f4b6584d031ed948c223f2e21b723369dab289d81663a906b28ddbd
- SSDEEP 384:bruCoi8I4tOx3HRAK739OC3SKGSnL/2W4HG6l0rY+0wo85TsZ+4:biGXhNVGSnL+m6lr+0wo8M+4
- TLSH
  T10492E8A4F1A3B117C3EB75B85D5F200C3B72A952C90BC011A65994A87DFDE889127F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  XenoServices-main/assets/js/modernizr.custom.js
- Size 14KB
- SHA256 5625dee7e745603b26355b4e37da24461b2c5a89bf7f0e81719fd240d1e5b830
- MD5 1f3491b83c41541d996533ef8a7cd392
- SHA1 1aafaae1bdaba0aabee8f34fac867f3a5c6e7ac5
- SHA512 69e1dc042d1dd1a3d40aaf5367cbba5ac020c3313bfe485b8860288a1d9f353c74c7352255dc472b79534799af7953580aa4e8d6fe89edb90482a71f4af9c756
- SSDEEP 384:fMgHW5MpTcaGd+lhZmA581KQoZRY5y6jHhRpz:fMEhhQAmKr25y6jHJ
- TLSH
  T18B62E9CDB153B11A8397A07A517F460FF23D98A998184854E059C5FCBE74CA8473BF1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  XenoServices-main/assets/js/nicescroll.js
- Size 55KB
- SHA256 187751ad90374cdea5cd7f83df994f5852a16057028ac0e595f371b8352a722f
- MD5 614865361cbb4b205e62de4540b69d78
- SHA1 ac0d12345f625839f3283297a390bbeb00bf6fb2
- SHA512 5c98e626f6c0a048e45cbe043fc549639dadf6b34dbb1416154eeb046d7c229bf8fb5a895fbc1a82a315b8bdc5e94b593c4c062c4d1a06f7788bdfe663e73501
- SSDEEP 768:fmmChxb0Nmwi/hEj5pRiNASd72vRkvrEXwD1/E44r:fE+owi/hY5xSd0/U/H4r
- TLSH
  T1CB43A6CD7623346701DEA335D18F4B4A213A9856770784E8762C9CF46D29B7AB227B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32