Overview

overview

10

Static

static

3

Xeno-v1.3....55.exe

windows10-2004-x64

10

Xeno-v1.3....55.exe

windows11-ltsc_2024-x64

10

Xeno-v1.3....UI.exe

windows10-2004-x64

1

Xeno-v1.3....UI.exe

windows11-ltsc_2024-x64

1

Xeno-v1.3....x.html

windows10-2004-x64

6

Xeno-v1.3....x.html

windows11-ltsc_2024-x64

6

Xeno-v1.3....ain.js

windows10-2004-x64

3

Xeno-v1.3....ain.js

windows11-ltsc_2024-x64

3

Xeno-v1.3....lua.js

windows10-2004-x64

3

Xeno-v1.3....lua.js

windows11-ltsc_2024-x64

3

Xeno-v1.3....ain.js

windows10-2004-x64

3

Xeno-v1.3....ain.js

windows11-ltsc_2024-x64

3

Xeno-v1.3.....de.js

windows10-2004-x64

3

Xeno-v1.3.....de.js

windows11-ltsc_2024-x64

3

Xeno-v1.3.....es.js

windows10-2004-x64

3

Xeno-v1.3.....es.js

windows11-ltsc_2024-x64

3

Xeno-v1.3.....fr.js

windows10-2004-x64

3

Xeno-v1.3.....fr.js

windows11-ltsc_2024-x64

3

Xeno-v1.3.....it.js

windows10-2004-x64

3

Xeno-v1.3.....it.js

windows11-ltsc_2024-x64

3

Xeno-v1.3.....ja.js

windows10-2004-x64

3

Xeno-v1.3.....ja.js

windows11-ltsc_2024-x64

8

Xeno-v1.3....nls.js

windows10-2004-x64

3

Xeno-v1.3....nls.js

windows11-ltsc_2024-x64

8

Xeno-v1.3.....ko.js

windows10-2004-x64

3

Xeno-v1.3.....ko.js

windows11-ltsc_2024-x64

3

Xeno-v1.3.....ru.js

windows10-2004-x64

3

Xeno-v1.3.....ru.js

windows11-ltsc_2024-x64

3

Xeno-v1.3....-cn.js

windows10-2004-x64

3

Xeno-v1.3....-cn.js

windows11-ltsc_2024-x64

3

Xeno-v1.3....-tw.js

windows10-2004-x64

3

Xeno-v1.3....-tw.js

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    Xeno-v1.3.55.zip
  • Size 89.0MB
  • Sample260630-a7wvjsbs91
  • SHA256 2ea8e000fcd3ef15acf7a20185b64d43f05599aba49f4bea5e2e9695476cc6aa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
salatstealeradwarecredential_accessdiscoveryexecutionpersistencespywarestealerupx

Malware Config

Targets

    • Target
      Xeno-v1.3.55/Xeno-v1.3.55.exe
    • Size 88.3MB
    • SHA256 0997ceb54430dadd0b4901c968e0c404fafba4ca377441ca09c54210601c007a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    credential_accessdiscoverysalatstealerspywarestealerupx

    • Detect SalatStealer payload

    • Family: salatstealer

      SalatStealer is a stealer that takes sceenshot written in Golang.

      stealersalatstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2
    • Target
      Xeno-v1.3.55/XenoUI.dll
    • Size 145KB
    • SHA256 d12e9318898f2aff7494fe89a2a8d3e55b2b7cf45ff74e66e152f4ced2012aab
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      Xeno-v1.3.55/editor/index.html
    • Size 164KB
    • SHA256 43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discovery

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    behavioral5behavioral6
    • Target
      Xeno-v1.3.55/editor/vs/base/worker/workerMain.js
    • Size 133KB
    • SHA256 e90d1a8f116fa74431117a3ad78dde16dde060a4bf7528dfe3d5a3ad6156504b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral7behavioral8
    • Target
      Xeno-v1.3.55/editor/vs/basic-languages/lua/lua.js
    • Size 4KB
    • SHA256 ac729efb3164f48d6b08f74d4b15060c126a30d40fb4cd4fc9cc94f2e19bd7c7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral10behavioral9
    • Target
      Xeno-v1.3.55/editor/vs/editor/editor.main.js
    • Size 2.1MB
    • SHA256 b604b6148f70fe9db882cce2a7d327b2422ad2f203a805491002a8c564e3c3ff
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral11behavioral12
    • Target
      Xeno-v1.3.55/editor/vs/editor/editor.main.nls.de.js
    • Size 46KB
    • SHA256 cb1c3416ff242a738c45c3b2590d7d222b159a95a69ce3b7b8d7c8d18ea70828
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral13behavioral14
    • Target
      Xeno-v1.3.55/editor/vs/editor/editor.main.nls.es.js
    • Size 46KB
    • SHA256 327437ee3793e9ae0686c78196b459592c282ed2e86f95ce28d32693b76d7654
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral15behavioral16
    • Target
      Xeno-v1.3.55/editor/vs/editor/editor.main.nls.fr.js
    • Size 49KB
    • SHA256 6ed837dc1905c06a20d102921ff06a0bda003c5368ed0576bf7e69494e889ae8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral17behavioral18
    • Target
      Xeno-v1.3.55/editor/vs/editor/editor.main.nls.it.js
    • Size 48KB
    • SHA256 4fe2c4420294758883e134bdf7da9e6c2abf631d3a89c765f32f6c1d0f62653c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral19behavioral20
    • Target
      Xeno-v1.3.55/editor/vs/editor/editor.main.nls.ja.js
    • Size 52KB
    • SHA256 1f3556ea7233843b9e08b3c97b6727c533d702563e195c2090a438070dc85f0f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    executionadwarepersistencespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral21behavioral22
    • Target
      Xeno-v1.3.55/editor/vs/editor/editor.main.nls.js
    • Size 38KB
    • SHA256 5ff0084e6a7eee82a735616239aaf2190ea9d90e89e19340831f3d590828016a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    executionadwarepersistencespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral23behavioral24
    • Target
      Xeno-v1.3.55/editor/vs/editor/editor.main.nls.ko.js
    • Size 46KB
    • SHA256 98e649fa40d8e2ccfdc212341feb8165a7d7bbec31e8a77d9819ad9474e4b8ba
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral25behavioral26
    • Target
      Xeno-v1.3.55/editor/vs/editor/editor.main.nls.ru.js
    • Size 75KB
    • SHA256 1bb069d95a395bf258d1f262814591aa762c4b30529adde32ccbcaa7c7ca508d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral27behavioral28
    • Target
      Xeno-v1.3.55/editor/vs/editor/editor.main.nls.zh-cn.js
    • Size 36KB
    • SHA256 e9adc8ffca9853ef6e0bd4e955af9f395a570bc7772fc2dac0c0ff241aac864b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral29behavioral30
    • Target
      Xeno-v1.3.55/editor/vs/editor/editor.main.nls.zh-tw.js
    • Size 36KB
    • SHA256 94a7ff81b8ec3217a46bc5cdebe2c6aee98f73e6e902b7d9cf394836d052bbe5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

JavaScript

1
T1059.007

Persistence

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

2
T1120

Query Registry

5
T1012

System Information Discovery

6
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

credential_accessdiscoverysalatstealerspywarestealerupx
Score
10/10

behavioral2

credential_accessdiscoverysalatstealerspywarestealerupx
Score
10/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

discovery
Score
6/10

behavioral6

discovery
Score
6/10

behavioral7

execution
Score
3/10

behavioral8

execution
Score
3/10

behavioral9

execution
Score
3/10

behavioral10

execution
Score
3/10

behavioral11

execution
Score
3/10

behavioral12

execution
Score
3/10

behavioral13

execution
Score
3/10

behavioral14

execution
Score
3/10

behavioral15

execution
Score
3/10

behavioral16

execution
Score
3/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

execution
Score
3/10

behavioral20

execution
Score
3/10

behavioral21

execution
Score
3/10

behavioral22

adwareexecutionpersistencespyware
Score
8/10

behavioral23

execution
Score
3/10

behavioral24

adwareexecutionpersistencespyware
Score
8/10

behavioral25

execution
Score
3/10

behavioral26

execution
Score
3/10

behavioral27

execution
Score
3/10

behavioral28

execution
Score
3/10

behavioral29

execution
Score
3/10

behavioral30

execution
Score
3/10

behavioral31

execution
Score
3/10

behavioral32

execution
Score
3/10