a5e272682b60ac91fe6b5161c516aa942bf0bcfa3364d427423192fb60453597

Sharing

Copy URL Twitter E-mail

General

Target
Xeno-v1.3.zip
Size 19.6MB
Sample260707-p2wpxsas71
SHA256 a5e272682b60ac91fe6b5161c516aa942bf0bcfa3364d427423192fb60453597
MD5 fc6f1df6893555b98a2b661e3d082f86
SHA1 9c385f1194a7cde72259e6b840b906a4afc96cb6
SHA512 2bb440481704fd21b19e4d4632da31a0f23a133a7ade60e5b3631418c7934345b5bcea046b56b2371152cbadac09e094945b9b779b10cc9ee5e9bcda2e50332d
SSDEEP 393216:viSjCLBWtCiDg5goLotopT6zPXOOfIP8t5ZKVUQ1FdaV6OkkuQtNhTnhqC:vLCLNiPoLotopOzPRfWQ5Za3dawWugbl
TLSH
T11B27331292CF231DF8E776FC5AF91BA7D2A1B59FE8C201E2147022948857B77B39211D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Xeno-v1.3.zip
- Size 19.6MB
- SHA256 a5e272682b60ac91fe6b5161c516aa942bf0bcfa3364d427423192fb60453597
- MD5 fc6f1df6893555b98a2b661e3d082f86
- SHA1 9c385f1194a7cde72259e6b840b906a4afc96cb6
- SHA512 2bb440481704fd21b19e4d4632da31a0f23a133a7ade60e5b3631418c7934345b5bcea046b56b2371152cbadac09e094945b9b779b10cc9ee5e9bcda2e50332d
- SSDEEP 393216:viSjCLBWtCiDg5goLotopT6zPXOOfIP8t5ZKVUQ1FdaV6OkkuQtNhTnhqC:vLCLNiPoLotopOzPRfWQ5Za3dawWugbl
- TLSH
  T11B27331292CF231DF8E776FC5AF91BA7D2A1B59FE8C201E2147022948857B77B39211D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Xeno-v1.3.55/Newtonsoft.Json.dll
- Size 695KB
- SHA256 22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07
- MD5 adf3e3eecde20b7c9661e9c47106a14a
- SHA1 f3130f7fd4b414b5aec04eb87ed800eb84dd2154
- SHA512 6a644bfd4544950ed2d39190393b716c8314f551488380ec8bd35b5062aa143342dfd145e92e3b6b81e80285cac108d201b6bbd160cb768dc002c49f4c603c0b
- SSDEEP 12288:mFIM0KteTMN4Or4D3OdmZg5WHEaEDIGBBjgrIQtD+tVqDMW:6zMTMNNd+g5Wk78GBBjgrIQtDF
- TLSH
  T165E45A2123E99B2BE0AF2775B032491647FAF542F6B7D78F5604D8AA1C43F558D82323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Xeno-v1.3.55/Xeno.dll
- Size 2.3MB
- SHA256 bbe77d09f56ad5bfa862b7b90323083d7e60fe7c2d62308a4950eeea583a5367
- MD5 e20d39365b01202e32f3833b03c88b28
- SHA1 29d0737a03203d58cde03e62d69694413a428f30
- SHA512 93c723f9b9b63be2f2c72d15f1f3cbf78ecc4b698caa98645f93ea92f43393f954c7c002e70e7571031c7344e2bb35b4aa1e90f2856698932b5845575b54f62b
- SSDEEP 49152:zIMHwQLHRlQWH8ra1/dtOyv37wVVpmZZuqrJ17/MN:zqz0/ZTq
- TLSH
  T1CEB59F17A6A901ECD076D1F88A5B5513E7B17C4903206BEB02E0B5752F27AF68F3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Xeno-v1.3.55/Xeno.exe
- Size 164KB
- SHA256 831bff95f6eb27d3da6b0def8b5dc994a0bfb3b284be73e4e9bf47882e8f1190
- MD5 895ceb92504645c29d2ea566980f07e9
- SHA1 3bca6884a2f3c5da512547aa2c08513c4633c20b
- SHA512 aa8a1c4b3f9efdb809cb0769897d170b96980ea2e7c5314438d3655aa0a594c17048d12f08f19b5911fa0c9b6812a4da72ddb565a2667f528514d684e7f9d9a3
- SSDEEP 3072:U20jWfVKLer5haSpfO9D/y7jXEkemZA4nsSyU34HW:JIVSpfO9jkS44U2W
- TLSH
  T117F33B07A6A850BEE1B3D679C9924941FB723C594B71A6CF03507AB60F777D0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
behavioral7 behavioral8
- Target
  Xeno-v1.3.55/Xeno.exe.WebView2/EBWebView/Default/Extension State/000003.log
- Size 114B
- SHA256 e2610960c3757d1757f206c7b84378efa22d86dcf161a98096a5f0e56e1a367e
- MD5 891a884b9fa2bff4519f5f56d2a25d62
- SHA1 b54a3c12ee78510cb269fb1d863047dd8f571dea
- SHA512 cd50c3ee4dfb9c4ec051b20dd1e148a5015457ee0c1a29fff482e62291b32097b07a069db62951b32f209fd118fd77a46b8e8cc92da3eaae6110735d126a90ee
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral9
- Target
  Xeno-v1.3.55/Xeno.exe.WebView2/EBWebView/Speech Recognition/1.15.0.1/manifest.json
- Size 76B
- SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
- MD5 ba25fcf816a017558d3434583e9746b8
- SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
- SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
- TLSH
  T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  Xeno-v1.3.55/Xeno.exe.WebView2/EBWebView/Subresource Filter/Indexed Rules/37/10.34.0.84/LICENSE
- Size 24KB
- SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
- MD5 aad9405766b20014ab3beb08b99536de
- SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
- SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
- SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
- TLSH
  T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Xeno-v1.3.55/Xeno.exe.WebView2/EBWebView/Subresource Filter/Indexed Rules/37/10.34.0.84/Ruleset Data
- Size 5.1MB
- SHA256 0fe71bcd4548d4ab4c7911ee366228d5963cb8fecbdfcce4c4b9a551b731f007
- MD5 e65748ffb333ad2ac9314fbcaa0deec8
- SHA1 b752ad97c7511306e40b161acc923a2ed0f0377b
- SHA512 c0dd0e298a7c8fe954c5ef183e085d5530a2a59181b57bec5023c4d083cd48ca862583a64506c94e69b9f7b5fac022429c25eb4a6fc8f1c459e52c9cf35f1560
- SSDEEP 49152:KbG43nGi9FIOQcRBpb3a39PKZ80ToBrEawiT/+RHUsYtyssgPLF5PN3t8qOhixim:UL3P9Dx+DdF
- TLSH
  T1F846C413672C1722F092C13988F6CB317700F7E0A69696EDB6A4414F7D8D6726F1A27E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Xeno-v1.3.55/Xeno.exe.WebView2/EBWebView/Subresource Filter/Unindexed Rules/10.34.0.84/Filtering Rules
- Size 2.1MB
- SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
- MD5 43f62d9f35fa6597cec4e2ad5643e282
- SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
- SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
- SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
- TLSH
  T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Xeno-v1.3.55/Xeno.exe.WebView2/EBWebView/Subresource Filter/Unindexed Rules/10.34.0.84/Filtering Rules-AA
- Size 2.3MB
- SHA256 95beb1f39b4cd5b29f5ebaced4a33753fb0bb876f078ed3de041f12be16cec5c
- MD5 b91a6cf79bedefedcb5603d3477cc3ed
- SHA1 b3512a426a6a613f8cdf7f9ae3a0d02b700d1843
- SHA512 9d85945f7f963fd9277adc20a0af459e8bb5904ef7038584e510ebd041b3029bf24ecae2047b24ecfa853154beef7e2bc5bd34ff8d90aeda000fbcdde741341d
- SSDEEP 12288:DUoPNPlfiCBGkqNEWymqMD2N3FRgVfFRg3oFRgHsFRg/sFRg7dFRgImFRgJ1FRgs:JNhiSGkqdT5+9
- TLSH
  T189B51BF69947509145B9631938ADB2C82B14A28147ECCBF2EBB4C4AA2791DC737C05FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Xeno-v1.3.55/Xeno.exe.WebView2/EBWebView/Subresource Filter/Unindexed Rules/10.34.0.84/Filtering Rules-CA
- Size 11KB
- SHA256 65aa171487dca70aad69973d0459c6a4b0882fcc6223bdfb53cd9ab711c5b125
- MD5 40b3ba01a09be340fdf879f97b31c867
- SHA1 b6ac58d1653c1b76e0e9898b17cfea3e6b56de94
- SHA512 97f82f162588a761a13a2efd38d2c9518954400c7898cdd12923ce26e90818d94310b4a9f2a2cb2f55f5101c9a2e177dc1b14de8c9486eafc910271e2991dea9
- SSDEEP 96:MKSlCviF3P2DoTc+cTKSlCviF3P2Do3lTKSlCviF3P2DoT:MaviVucryaviVualTaviVuC
- TLSH
  T17C3275333E488D6792A4C1A0DC92752C9E3087D98C9CBEC31235B9776BD1E6A508B5F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Xeno-v1.3.55/Xeno.exe.WebView2/EBWebView/Subresource Filter/Unindexed Rules/10.34.0.84/LICENSE
- Size 24KB
- SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
- MD5 aad9405766b20014ab3beb08b99536de
- SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
- SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
- SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
- TLSH
  T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Xeno-v1.3.55/Xeno.exe.WebView2/EBWebView/Subresource Filter/Unindexed Rules/10.34.0.84/Part-DE
- Size 305KB
- SHA256 367ad4a5699a69499d13e8bf9ed5e8bab3573e3731ff8127178e539735ba46a8
- MD5 fa08e85d713ad46803e924d443e4bf7e
- SHA1 bbcce20f5ce73be4b34cf5c43d6f71bb4ae2c5ff
- SHA512 884314e04cab57c9907f90525a4fea7710fdff5e47db4500c03d4dc6c5491a3f4df4868620a2a1817444ee75bfc913e79f9a414e3a68108deb7abab700ae9f85
- SSDEEP 6144:7FjHKfRBie5M0SPtVRY7od0x6qNgKWIescUHVTl1dKcJEtmmt4l843NWKOb2P5+S:5T41N/IuscpL1Kxa
- TLSH
  T10264C693296AFAB12A320E7D600A1C4C5322F111C2C7DDD9F775C98DD1E468BBAC16F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  Xeno-v1.3.55/Xeno.exe.WebView2/EBWebView/Subresource Filter/Unindexed Rules/10.34.0.84/Part-ES
- Size 137KB
- SHA256 55e005c8aea4180093fcb56f4ddeb9fc763892d8cf1fcc840f612a7531b7ed18
- MD5 6e8f660d075254a08948dc3517304256
- SHA1 bc8abaa82d6d555ee9482c568a1d661453fbc956
- SHA512 cc3484fe628e4242eeec2ce969c51e817ec9ab3feecec8d8097f43a319c9dc226771eefe63316d8ec2ad895f23ed4603c4836faa49369db785580455ecf21f37
- SSDEEP 3072:NiZ3EhHST197h/6Jl06bBeS1G56asSnGpFrUboki9a8jRU+Zw1:/RxbR1EnYpLv/Vy
- TLSH
  T166D30D55AADCA8B55A73102C64D9254C911772D082CECDE4FB6686CECAE05CF3BA03FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  Xeno-v1.3.55/Xeno.exe.WebView2/EBWebView/Subresource Filter/Unindexed Rules/10.34.0.84/Part-FR
- Size 528KB
- SHA256 56e80041432156be4f08bac11e3494f2f06f65b61a60b7dcb61d15debb7b318c
- MD5 6804859c589fa0ce46529c3a53b882d6
- SHA1 70ffd62bb826e29500d36bbdd7c8d9c6895e2d1d
- SHA512 3a659c284f55d203fded7f2754673e55a43d2c131b4790fcfe374af138158a690b5a330d4e720348c03aabb561b0aee7d818dcc111698c05ecd99c239d07735c
- SSDEEP 6144:zfi0kH6u1I6c2Qiw934vv8gxK2SzX6rDVu9cBwZp0CiEksn7p0heBB6pHIgnb3hc:aT43+R5I7p0ABaIgne
- TLSH
  T114B45D136619F9F11FB31E3D640B5C088235B2A183E3EDD5EA67C14DD4E468FB9A02B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  Xeno-v1.3.55/Xeno.exe.WebView2/EBWebView/Subresource Filter/Unindexed Rules/10.34.0.84/Part-IT
- Size 216KB
- SHA256 e1552312fc16e0f279e72f7eb4189a47e0beb36733220b0ef605f66defcc5fa7
- MD5 268f6a3c0990d434175268cf09cfa6ad
- SHA1 464e10c57c536e6bb55a326a48469246a9241505
- SHA512 5154048a794227c45b950ec2d2ca378f9e7a9542b9fc79c1fef1f1615e97a263168927d883967b06f8b52227a47e3ac75ac7061b25400ebaa63e4536a368d50a
- SSDEEP 6144:1quRAGty7QiWYIeezuu2CGiXTyRl+XPWRq14T/KfY:HRZtQl+XPWRS4T/5
- TLSH
  T16524E9176A54EDBE4E22156CA09F5E0C7225758182C7CED4F3D5C08DE5F827A2BA03EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Downloads MZ/PE file

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32