General
- Target Xeno-v1.3.55.zip
- Size 6.8MB
- Sample260624-tp941adw7j
- SHA256 7d89aca3584916e86707d8c9c6af606491bc9a3cadff9aea85a95f97a7a02a0b
Malware Config
Targets
-
- Target Xeno-v1.3.55.zip
- Size 6.8MB
- SHA256 7d89aca3584916e86707d8c9c6af606491bc9a3cadff9aea85a95f97a7a02a0b
Score8/10Downloads MZ/PE file
Executes dropped EXE
Loads dropped DLL
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Checks whether UAC is enabled
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Network Share Discovery
Attempt to gather information on host network.
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target Xeno-v1.3.55/api-ms-win-crt-stdio-l1-1-0.dll
- Size 17KB
- SHA256 2a466648affd3d51b944f563bb65046a3da91006a0d90fb2c0b123487a1fc1b3
Score1/10 -
- Target Xeno-v1.3.55/api-ms-win-crt-string-l1-1-0.dll
- Size 18KB
- SHA256 bf4ea10be1b64c442ac0ccf4bdf69f6703467176a27e9e14a488d26448a6e179
Score1/10 -
- Target Xeno-v1.3.55/api-ms-win-crt-time-l1-1-0.dll
- Size 13KB
- SHA256 b56bc94e8539603dd2f0fea2f25efd17966315067442507db4bffafcbc2955b0
Score1/10 -
- Target Xeno-v1.3.55/api-ms-win-crt-utility-l1-1-0.dll
- Size 18KB
- SHA256 984306a3547be2f48483d68d0466b21dda9db4be304bedc9ffdb953c26cac5a1
Score1/10 -
- Target Xeno-v1.3.55/concrt140.dll
- Size 316KB
- SHA256 2405355f0a58067b258f8df33c327e3a3d716eaac5a3a5aebb757842d85bd376
Score1/10 -
- Target Xeno-v1.3.55/editor/index.html
- Size 164KB
- SHA256 43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2
Score6/10Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Xeno-v1.3.55/editor/vs/base/worker/workerMain.js
- Size 133KB
- SHA256 e90d1a8f116fa74431117a3ad78dde16dde060a4bf7528dfe3d5a3ad6156504b
Score3/10 -
- Target Xeno-v1.3.55/editor/vs/basic-languages/lua/lua.js
- Size 4KB
- SHA256 ac729efb3164f48d6b08f74d4b15060c126a30d40fb4cd4fc9cc94f2e19bd7c7
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Xeno-v1.3.55/editor/vs/editor/editor.main.css
- Size 294KB
- SHA256 615824c59ed1e07f5924286e9f02f3120b9064d59e115d3f668a914e07839451
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target Xeno-v1.3.55/editor/vs/editor/editor.main.js
- Size 2.1MB
- SHA256 b604b6148f70fe9db882cce2a7d327b2422ad2f203a805491002a8c564e3c3ff
Score3/10 -
- Target Xeno-v1.3.55/editor/vs/editor/editor.main.nls.de.js
- Size 46KB
- SHA256 cb1c3416ff242a738c45c3b2590d7d222b159a95a69ce3b7b8d7c8d18ea70828
Score3/10 -
- Target Xeno-v1.3.55/editor/vs/editor/editor.main.nls.es.js
- Size 46KB
- SHA256 327437ee3793e9ae0686c78196b459592c282ed2e86f95ce28d32693b76d7654
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Xeno-v1.3.55/editor/vs/editor/editor.main.nls.fr.js
- Size 49KB
- SHA256 6ed837dc1905c06a20d102921ff06a0bda003c5368ed0576bf7e69494e889ae8
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Xeno-v1.3.55/editor/vs/editor/editor.main.nls.it.js
- Size 48KB
- SHA256 4fe2c4420294758883e134bdf7da9e6c2abf631d3a89c765f32f6c1d0f62653c
Score3/10 -
- Target Xeno-v1.3.55/editor/vs/editor/editor.main.nls.ja.js
- Size 52KB
- SHA256 1f3556ea7233843b9e08b3c97b6727c533d702563e195c2090a438070dc85f0f
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Xeno-v1.3.55/editor/vs/editor/editor.main.nls.js
- Size 38KB
- SHA256 5ff0084e6a7eee82a735616239aaf2190ea9d90e89e19340831f3d590828016a
Score3/10 -
- Target Xeno-v1.3.55/editor/vs/editor/editor.main.nls.ko.js
- Size 46KB
- SHA256 98e649fa40d8e2ccfdc212341feb8165a7d7bbec31e8a77d9819ad9474e4b8ba
Score3/10