b23c331024751289d1a3c5058c497c218d070a42d2e0b0d4c2756cede280ea3a

General

Target
Xeno_v1.3.29978_TZwngK.zip
Size 2.1MB
Sample260706-k4j2pacy8w
SHA256 b23c331024751289d1a3c5058c497c218d070a42d2e0b0d4c2756cede280ea3a
MD5 fbaf636400d0bf46874e7961f1038144
SHA1 8109998e82529850dd0fed43f2758da9b817dfe9
SHA512 de4e7ce3c8ab59de9cdf5fdf723b4f83c2511b8bc9f0dcec564e179d7c3adebb228f15cc4eef1f981e354723e33efbbebe4e62806c2033ce91b6589f625cac7e
SSDEEP 49152:CjnkiSCn5V1IuvISz2H/LovnSb2hAUU1RVvu5J6RSowZq:585MDSI/LQnK22Thvl1wQ
TLSH
T191A53359BF186E9D79663FDB3F6501E23A4F2A44A873634346F31050B0EAEED816C253
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Xeno.exe
- Size 683KB
- SHA256 715b4174065916a6412f60b3c10664b323dc737fd717ab09627083be34626fe0
- MD5 6669e10c960f6c2297bcd3d5a27412aa
- SHA1 73bee544b24312d0057d9ce5e62daa9f73243d00
- SHA512 feb1e93aed3f1a0ade6e6ab169af46ddd438aa80f6667fb24421d2f0b7da1c4a4902438421079a75eecfc9a3347c3ebe7f62b88ea9e67a9c951954d8555ea497
- SSDEEP 12288:tiGbyLR32C4NHhZoLCZcvDaLgf5pB6Nwi5//E7soazN0uahRg:MGboR3P4NHboLCevWLGL6//E7sTN0hhC
- TLSH
  T1ECE48E2AB3E401F9D1B7D276C9535A26FB71780A1731CBCF03A046562F276A49E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access discovery ransomware spyware stealer
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  mpclient.dll
- Size 3.5MB
- SHA256 b8867ac880a508c58953132f3f08086331f937961fb1e80f8f7539f5df1ecce7
- MD5 4cf23b474e03286ffd280982588bd9ec
- SHA1 4e7fa54c381fb49167a52e1bdd59d8f955f501de
- SHA512 ee108317bab34ad8ce6eaf236b49b59d174af4dc4b653d7d4471121c291feb330c9edb46b131668501443e8ba3533ef42b14b22a1cafc43c0504bb0107344adb
- SSDEEP 49152:/t5018pSWSU9WfEZ0RTMG+Saq0wO8CpUElEa8W2bGXs44nx:/tyBtTmRr8GUK2beV4nx
- TLSH
  T102068C03ACD14AB9C19A933199A602927B7DFC494B323BD32E44B37A2F737E05975B50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2 behavioral3