7d89aca3584916e86707d8c9c6af606491bc9a3cadff9aea85a95f97a7a02a0b

Sharing

Copy URL Twitter E-mail

General

Target
Xeno-v1.3.55.zip
Size 6.8MB
Sample260707-2hznpafs91
SHA256 7d89aca3584916e86707d8c9c6af606491bc9a3cadff9aea85a95f97a7a02a0b
MD5 4cb6bc7c49c919065dab1c32d70df887
SHA1 31924dd424c5259988e1cda49a5bd730fbb2b284
SHA512 8d738a6b78f773d41332f401e31ccf6d5e8054a768120906e1d0501d11dc887d111f8c1a5f7f96119b67cb3bf5fc97dfe218e78007aa61819636708003c5099e
SSDEEP 196608:inFGt4gLGBvG7bM032XaCzn/sUH28DgajJ2qaJggT3OsR:inFi4gL/nMhhc8DgsaJgNsR
TLSH
T1D06633CCABE818D2FA3891796A3017F96653E3416716650BE50C04E772DAED04B87B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  Xeno-v1.3.55/Microsoft.Web.WebView2.Core.dll
- Size 557KB
- SHA256 11e88b2ca921e5c88f64567f11bd83cbc396c10365d40972f3359fcc7965d197
- MD5 b037ca44fd19b8eedb6d5b9de3e48469
- SHA1 1f328389c62cf673b3de97e1869c139d2543494e
- SHA512 fa89ab3347fd57486cf3064ad164574f70e2c2b77c382785479bfd5ab50caa0881de3c2763a0932feac2faaf09479ef699a04ba202866dc7e92640246ba9598b
- SSDEEP 12288:6CxswUBor35JrpQ322zy+uFKcDoRFNCMmeA+imQ269pRFZNIEJdIEY0lxEIPrEIE:6Cbmv
- TLSH
  T15BC4402123FD8A1AE6F63BB5A57407709BFAFC967979D39D0598251C0D72B408AE0333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Xeno-v1.3.55/Microsoft.Web.WebView2.WinForms.dll
- Size 37KB
- SHA256 5696366f7458da940cc986dc5d3d4549a2368512acd769014ecbb07b47bd88b4
- MD5 8153423918c8cbf54b44acec01f1d6c2
- SHA1 f0c3c5412b809725e6d4809230adb15cc7d83ad2
- SHA512 f3dc771e37c71479d332142ec5a9c5c3f39ca71937f595a0f7482ae5aaaafd92e932efc9b0363d4511d547f3c8b2e0497ebbf8356e7d07fc344f4e5715b0ee87
- SSDEEP 768:1sjCEEHJ9l0EeFZ2sxIHzttZDgcEST3p4Jjrjh2jJ+SG2au8vxJKia5/Zi/ZGQKk:wCEB15azttZDgcEST3p4JjrjaJ+SG2a/
- TLSH
  T1B4034B0483DCC617D6EB6FB8A5B491620B7ABF837960D36D1C84F5E90DB37A0891076B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Xeno-v1.3.55/Microsoft.Web.WebView2.Wpf.dll
- Size 50KB
- SHA256 b628d6133bf57b7482a49aa158e45b078df73ee7d33137ac1336d24ac67ed1b4
- MD5 4a292c5c2abf1aab91dee8eecafe0ab6
- SHA1 369e788108e5fb0608a803fa2e5a06690b4464b5
- SHA512 ca22adfff9789730e4c02343e320d80b8466cfc5a15f662cefe376b7ee29dea571004c1c26cd3f50c0d24e646f2b36b53fa86835678f46f335d65eec52431cde
- SSDEEP 1536:gpGhWMhWLF9jwKi8LDP/ryEH0GBy4JjrD1aah/UaOzk6hKKa5/Bi/IGCv0Z0T6Cc:taBi8LDP/b0GBy4JjrD1aah/UaOzk6hz
- TLSH
  T12E33398047AD8533D6EF4FB450B481214B79BE83B9B1E78A1DC8F4E91DA77800A543AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Xeno-v1.3.55/Xeno.exe
- Size 160KB
- SHA256 098e0ddda1fa6cec7def5be97f6cd85df891324b5ccd52e001cf415e09ee557b
- MD5 06c6c8928a5f9f32ad4778ece45176f3
- SHA1 69941334c19ff637e65acf791b74600a76455842
- SHA512 e22018318c674426a2550fdad3ea2c80252b81eb9aedd58c0ff597fe7c82344c0274bda2b8b2814d6a3098a859756ab1747cc150ecc2bfff5fdf42b7ada9e558
- SSDEEP 3072:IqeXA/4yIg9vkNPNu6H6xCYOihUE265AJw41V0:IvgvkNFNaxmpEgJ1V0
- TLSH
  T1D4F34C07A6A851BDE1B6C678CD924D41FB727C598B71A6CF03507AB60E737D0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral7 behavioral8
- Target
  Xeno-v1.3.55/XenoUI.dll
- Size 145KB
- SHA256 d12e9318898f2aff7494fe89a2a8d3e55b2b7cf45ff74e66e152f4ced2012aab
- MD5 35352486776cd68ba3d38c79655fe145
- SHA1 4c287dd2db5b4f62637881c74ec0b0031e85d1fd
- SHA512 f8dbeb062dd4cd8e2117702c835ed580164f4dbb1485cd37f7dfcd7e9d327dcaf92722ded76a8b81690746304607b4fc1437ccf2b848ba5c3495131555b53b70
- SSDEEP 3072:91gdAO0a8Uw+2TbyG1XOQd7Pby6SgV9Sj0LC55dVPOdXmh94VM:4AnaC+2HyGBBby6p9Sj0Uh2dWAVM
- TLSH
  T112E3AF41376CCA12CABF0FBD64B152955A71BE17A5A3E70E14CC349C6CF738286523AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Xeno-v1.3.55/api-ms-win-crt-filesystem-l1-1-0.dll
- Size 13KB
- SHA256 51541ec6684b43157a85ea46a42ebed4555be06bed0d0d07ff3ea6377301318d
- MD5 42a2a95f1bb940d01f55eb1674a81fe2
- SHA1 f982f3bbb4dc3aaaba8df098d1b395846f7cba08
- SHA512 de9a7a1a6a45e2f76105eaeafcc3c29adbff142dcf2586e147417045b897a9dcddec5e1b97acfc5d3fc9c8e3a508dbc3f607bf3df20a7435e74436f94cb056b6
- SSDEEP 192:zt/PGnWlC0i5C9WphWAeD1S8f4DBQABJJ2yy2D8KN3qnajV2MVorr:VunWm5C9WphWbD1IDBRJJkt2lxnorr
- TLSH
  T18852F78347E47E02EAA72B3112FDDBDB3F3D5781185247668006A52839E73C1BF1659D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Xeno-v1.3.55/libcrypto-3-x64.dll
- Size 7.1MB
- SHA256 16e85806333aa3b3a4fe8c31c9402b78ee01a4a143e9031db165c48386dd6289
- MD5 b47c9988a203a596803837c128853517
- SHA1 2f669bf535dde5727989da919ffa5c36cf9d78e2
- SHA512 24874b5902785cea67d3781e59471e6b8fb8c9d9e6e33e8c894745eb4324bfa1ab123ff2809269e1a7b2eb604343efe556183479c0e0d30214dec252c31fb69b
- SSDEEP 196608:uHhm399Xki0GiR/8yGX26ui1CPwDvt3uFOxC:uHhm399XkifiR/8rGfi1CPwDvt3uFoC
- TLSH
  T164767BADA67C0109E8AA81BDC2979327D771B91957F013CF186196F80F23FD92B7A740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks whether UAC is enabled

Contacts third-party web service commonly abused for C2

Network Share Discovery

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13