80a801bfd1a77fe5ad8dab4117b9095ec614a17ca93daf201d05f36f7514c480

General

Target
Xeno_v1.3.36800_ZmUJSS.zip
Size 2.0MB
Sample260707-xpvk4ads2k
SHA256 80a801bfd1a77fe5ad8dab4117b9095ec614a17ca93daf201d05f36f7514c480
MD5 476730a2c9c02f98312c1faee8505ed4
SHA1 c5954a96b4e12f7c192ac2ac4ab527efc4613c6b
SHA512 43c72c691262cb73fb93f72bb8b029079385e5c67773b750257ecd8965e889ca116103eb5a8a22e624924605c006fae6081310c4898054fdcb1ba8834280a616
SSDEEP 49152:QKPp5VmhcSttl5kNfBI3w5BPOiiuuPjucWo:QKPpKzflefBT5Bm53P6s
TLSH
T14DA533333FC8C23E94523A8802E07DBBF63AD1B42C6A1D566D75567D4C801E952FAB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Xeno_v1.3.36800_ZmUJSS.zip
- Size 2.0MB
- SHA256 80a801bfd1a77fe5ad8dab4117b9095ec614a17ca93daf201d05f36f7514c480
- MD5 476730a2c9c02f98312c1faee8505ed4
- SHA1 c5954a96b4e12f7c192ac2ac4ab527efc4613c6b
- SHA512 43c72c691262cb73fb93f72bb8b029079385e5c67773b750257ecd8965e889ca116103eb5a8a22e624924605c006fae6081310c4898054fdcb1ba8834280a616
- SSDEEP 49152:QKPp5VmhcSttl5kNfBI3w5BPOiiuuPjucWo:QKPpKzflefBT5Bm53P6s
- TLSH
  T14DA533333FC8C23E94523A8802E07DBBF63AD1B42C6A1D566D75567D4C801E952FAB9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Xeno.exe
- Size 683KB
- SHA256 715b4174065916a6412f60b3c10664b323dc737fd717ab09627083be34626fe0
- MD5 6669e10c960f6c2297bcd3d5a27412aa
- SHA1 73bee544b24312d0057d9ce5e62daa9f73243d00
- SHA512 feb1e93aed3f1a0ade6e6ab169af46ddd438aa80f6667fb24421d2f0b7da1c4a4902438421079a75eecfc9a3347c3ebe7f62b88ea9e67a9c951954d8555ea497
- SSDEEP 12288:tiGbyLR32C4NHhZoLCZcvDaLgf5pB6Nwi5//E7soazN0uahRg:MGboR3P4NHboLCevWLGL6//E7sTN0hhC
- TLSH
  T1ECE48E2AB3E401F9D1B7D276C9535A26FB71780A1731CBCF03A046562F276A49E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2
- Target
  mpclient.dll
- Size 3.4MB
- SHA256 b3901bd46c539da1a713f91e20c4fc2eb9284da160515d5f4bfd38e796f6c6ec
- MD5 40996c83c6a1f7024befb9ded9a7e877
- SHA1 a03ce89547dc8b86dd77a4bdda9e75b1a8f690d9
- SHA512 97d73ff42cbc7bb594fddf460d353566e7186623f3ffd600bf5d1f601a8f624dced49bb10bf339d5b1bbac1ad57dea4a302906569a368ae0b3d0e48599f873d4
- SSDEEP 49152:hhLCRKjbEgnGErNkpM4aEP1Z5Sm+y997X/NX/i9Bd/15LdVakxa:hh2kANvg15Ld/xa
- TLSH
  T14DF5AE0BACD04CA5D4AA573689B70291BB3CBC684B3227D72E54B6792F737D06D36B40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3