Xenos.zip
- SHA256 c144fd0c9ee115aa91990dea1f8cbfc295d5ac0c13f4b9fbfe8d6f95f35368ed
Password
123
Overview
overview
8Static
static
5Xenos/Xenos.exe
windows11-ltsc_2024-x64
8Xenos/engine/core.dll
windows11-ltsc_2024-x64
1Xenos/engi...me.dll
windows11-ltsc_2024-x64
1Xenos/exte...t1.dll
windows11-ltsc_2024-x64
1Xenos/exte...t2.dll
windows11-ltsc_2024-x64
1Xenos/exte...t3.dll
windows11-ltsc_2024-x64
1Xenos/hand...er.dll
windows11-ltsc_2024-x64
1Xenos/hand...er.dll
windows11-ltsc_2024-x64
1Xenos/reso...ve.dll
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Xenos/Xenos.exe
Resource
win11ltsc2024-20260709-de
windows11-ltsc_2024-x64
6 signatures
300 seconds
Behavioral task
behavioral2
Sample
Xenos/engine/core.dll
Resource
win11ltsc2024-20260709-de
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
Xenos/engine/runtime.dll
Resource
win11ltsc2024-20260709-de
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
Xenos/extensions/ext1.dll
Resource
win11ltsc2024-20260709-de
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral5
Sample
Xenos/extensions/ext2.dll
Resource
win11ltsc2024-20260709-de
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral6
Sample
Xenos/extensions/ext3.dll
Resource
win11ltsc2024-20260709-de
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral7
Sample
Xenos/handlers/handler.dll
Resource
win11ltsc2024-20260706-de
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral8
Sample
Xenos/handlers/loader.dll
Resource
win11ltsc2024-20260706-de
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral9
Sample
Xenos/resolvers/resolve.dll
Resource
win11ltsc2024-20260709-de
windows11-ltsc_2024-x64
0 signatures
300 seconds
General
- Target Xenos.zip
- Size 20.1MB
- Sample260709-wkpcvafs2k
- SHA256 c144fd0c9ee115aa91990dea1f8cbfc295d5ac0c13f4b9fbfe8d6f95f35368ed
- MD5 453bc316f6c663fc72aa0f7ad24f6e3e
- SHA1 43ca9b782de3d606762a9c79650d39ded459e259
- SHA512 949796849aeebd014473e03dbdea96777222768910fbb858dcd1e4dbb3be1c58160e2a6c6b56c5badd20d98f91a6d0d9056596e5dfc42a33cace604a952dcc4e
- SSDEEP 393216:sq0nR5YBj7PDkbcRWHoDSAfsy+RBXZxsuuEMTKNDlq5ebW1eLT:snRKfobckHGlfsvR9ZxMFeNDlq5Szf
- TLSH T1AD27334E447C1476E691F9BED013AC761F59A35FEAA26C4EB2896A2C73007C8F14BCC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/Xenos/Xenos.exe
File Explorer
-
Xenos.zip.zip 20.1MB
-
Xenos/Xenos.exe.exe 26.1MB
-
Xenos/engine/core.dll439KB
-
Xenos/engine/runtime.dll178KB
-
Xenos/extensions/ext1.dll305KB
-
Xenos/extensions/ext2.dll283KB
-
Xenos/extensions/ext3.dll753KB
-
Xenos/handlers/handler.dll1019KB
-
Xenos/handlers/loader.dll976KB
-
Xenos/readme.txt19B
-
Xenos/resolvers/resolve.dll143KB
Xenos/Xenos.exe
- IMPHASH 01dd3c4268e4e362eb742c4e00563f07
- SHA256 c02599445176620d4d00bd1b706fffa150bef864d30a4629df5fd74a79cc8e53
- MD5 ff0fb3de804e8b8a9bcfd5adf8f959fd
- SHA1 1dfcde2a11d6a02c0ec91ec9accdccb2639c202c
- SHA512 7f7228d14fe31b195ba17824fc9fa6e8d43678ddbab545541f84cd97f1e09bc63f1a1b5707f6fdd80c94a81280117c3dbc894436106e6780db1185fcb34032be
- SSDEEP 49152:o6Qjg9wUD8MBM5sbMaEkluX71lGpvXL2W30fdVuZEapJiNG+DMw6LiKnivb5kYnA:N
- TLSH T145578C7FC13B0827AE9B67C58C591ACADC4CE7512710646976AD188EC728EBFC0E1637
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
Password
123
PE Signature issue
Digest
d2:89:74:d2:7e:b1:31:cb:3c:4f:cf:00:06:6e:30:b6:10:71:d5:8e:cd:9a:02:79:72:7a:1e:b3:2a:f2:16:2d
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=4559077,CN=Now.gg\, INC,O=Now.gg\, INC,L=Campbell,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Aug 29, 2025
SERIALNUMBER=4559077,CN=Now.gg\, INC,O=Now.gg\, INC,L=Campbell,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=4559077,CN=Now.gg\, INC,O=Now.gg\, INC,L=Campbell,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=4559077,CN=Now.gg\, INC,O=Now.gg\, INC,L=Campbell,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0d:f2:24:41:e7:a2:4c:bc:b5:fe:9e:70:58:24:2e:b9
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 18, 2025 - Mar 17, 2027
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
4800
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
ExitProcess
GetCurrentProcess
GetCurrentProcessId
GetLastError
GetModuleHandleA
GetProcAddress
GetTempPathA
GetTickCount
GetWindowsDirectoryA
QueryPerformanceCounter
SetLastError
user32
DestroyWindow
GetActiveWindow
GetCursorPos
GetForegroundWindow
GetSystemMetrics
LoadCursorA
LoadIconA
MessageBoxA
PostQuitMessage
ReleaseDC
SendMessageA
ShowWindow
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc2
Size
512B
Virtual Size
28B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
26.0MB
Virtual Size
26.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Xenos/engine/core.dll
- SHA256 eac9a8d33e5fbd28e93fe9a58c36403ceda5348a648f14692663890402867c45
- MD5 a54b3593144f51a9f239195bad716aa3
- SHA1 919557ec1058e2420a43dc17cda884bf0bf32c29
- SHA512 fd67a83e60b0df4c13a114017b5e0d8756aeaf066f67813a8d59647d3a540a9b302890222b388c54eb38b8168d729e4f45ab383a3015443d8079ff73e64b401f
- SSDEEP 12288:JBVH8DBjhHHCJdPzSYLyrWmuthKYEqjkzLpZnwy9:JBVWFnoLyWjthKYEqIUy9
- TLSH T169A4239E0E4EF08C825065406E273BD855BB01AB3BCCE7590879FE4A5D48E59C19DEF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Xenos/engine/runtime.dll
- SHA256 d90be834f52a684acd23f238bea0b8445ee364d5abbbad9da3817b3db1e8a9d5
- MD5 7dad42105118b5a1427ba1a2b0437b83
- SHA1 27626d93799a11586ec6850fcc6d5f897c20893d
- SHA512 0653d0c2a27c1899ae17ebb95da65bc6374d007155a46afde2460fbc9139417e61cd89e7a380abdbb0f90e99d446e51e2bf544dc2d3ffbb22ba8e973d370a2d1
- SSDEEP 3072:6N11empQqQHWmrhpd/lR6uSWUwEf4cJaE5OR8rMPcXak9Tt+KbAsBMWp3Arxci37:6N1HQHWm9rlRYhwE48aGOR84PcXlnhpA
- TLSH T19504120B01B9D393C3E632C5BBB26376F6CF366B24FB244593C04591D47256229B56F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Xenos/extensions/ext1.dll
- SHA256 0bdbfc2778e4217b42ca0acea6ba3f0b4e33b74a57dd4b04a055444fdfee8b53
- MD5 57a0a800fc63f8896fa317eab466f5ae
- SHA1 250efbe73d1b5b666f3163dff906250c10a0e85a
- SHA512 e3fa3d9999af593e19464ffb05b17fe35a09790e6acb8ed220f534d34e02832532d4a27eda6f4dc1aca2732e171e68d594181047df3bd9c0e3e3d1a2e4366135
- SSDEEP 6144:3wCFH0WOEKJY6uvjhQLulouoIeVfsh4xC5TNMZ1ZNVItS:uW9KG6utAAHcS485I1nVIA
- TLSH T1A36423F8505B40FA424E449813CF01740E66D66A363C89AE37FF37D46B4B4E067AAF99
- MD5 SHA1 SHA512 SSDEEP TLSH
Xenos/extensions/ext2.dll
- SHA256 f3b49a53fbcff192209757c84b33913934739383bd67b0bf8ff5b66225b4471a
- MD5 4b2943fc73565a8b6cf73e3b850970f3
- SHA1 62e5ee62a1a2b1d9c0c102b8d8e4fad8db6f09be
- SHA512 0aef8bcf62b210cd7e966f78c02a73d1d89ee53fe2c306e6f2cce8033cd4e8bc456db61bdd25c1f4bf4db291d7eaabc8c59d2b50a9106fed11b4e9e465203693
- SSDEEP 6144:uFHeig9kXZqb6FjIE+Kb1K+73grhmbxWrzlPSNGoE28qqZPS3Q0ByBOd:uF+ig+XZqGFjIQb1K+grExWrBuEd1ZPU
- TLSH T14854237D32EFD000E9F8CF03D80A8553465DD926E819E2EA7A40429DABE1971FE37523
- MD5 SHA1 SHA512 SSDEEP TLSH
Xenos/extensions/ext3.dll
- SHA256 fff7e82cdb3f1d9acaae444f6cf8b076a17658bde5e727cabd9e22523000523f
- MD5 a32123862438c66325d11f3889c971be
- SHA1 444144d0390e1b88904216f553b66c748b840885
- SHA512 a4f8a5be5ce7afddea809a8778d7d1de2383daae37bf2b558c34751775ea292c1852b3f4dbd627713b281dc13b752e5aa69a83e46a3e87129f2aa7051723cf75
- SSDEEP 12288:3N4C4QyVAxcICi3xwshgv7uR03ORsGCYz+54L2R2T0yJDBI/Ht0bqIAv01E:94CIVaRzmHvj3OuwS2FyV0bq4E
- TLSH T105F4230DD01E1AEE6EF1D065AF290D47F199DB002B17C9DF2A552E78C4463FA1BB02DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Xenos/handlers/handler.dll
- SHA256 15c959376523dc9733e20aea01effb50fecc7aa5e59a0ac5cf6cb969dae13312
- MD5 3ee5870b3a1eb7938f5ef20622e971d1
- SHA1 c7eb5353b01fe70e1f2225ca821f78fab2c93574
- SHA512 9fbbe85b9ff01740b5c6e3ace985c6d452f6b612eff2bce71bafcaf6ac4ecbb66de4d2b9cc72e380b901012311bad6f0094101fd808bdfe550322b73e95226a8
- SSDEEP 24576:3IOB93UuDI1P1heAq2HLaczTK4GpefYZQkkwSaw:YOn3UqIxRjJybZQqSaw
- TLSH T12825334ED864C946711C1FB4ABFE10C7A77B5AFFE68272258E5FE092391D0A0582D8F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Xenos/handlers/loader.dll
- SHA256 1922725f96f456911794d36d4ccb5890af0f4835d3a0ff15738224da176eff8b
- MD5 9cbebf3ddb341895f689bd7a9c522ab5
- SHA1 2e8f73a2a104184b63ded70ade1a70ad419b6e5a
- SHA512 3853ecd3d3011318a8b62760d1bf4f79f3ccd188ce1b18dc0eefbe184472af72c355c097119e1be8edc48b486088285fabbb89a867d2bdaa42d7ae198a6e6efc
- SSDEEP 24576:7+wZZl11NX0hXeKvurAWiUdroNwzWJOzFj/5EXHMLzq/uHlIP:7+u10hXi/ft/5UL/uHlIP
- TLSH T10A2533AA9FC0B60D880AE5A00F0F67F4A4441C5645DB2A7D33535F7B28387DB27F65A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Xenos/readme.txt
- SHA256 251ae5652575d62495bc49384093e28a2bd1363898b257196227614442368cff
- MD5 6b1dff5325083fdef688af11f310e1b0
- SHA1 8eef88342f3e77669a210fc650a1348eb7b072a7
- SHA512 6e7406f010100be4c21ef44545157c4ddca5ede4242ecdfd85f6f4f05047f3c66089e403f7d0ec91c057e8188917f3a1e3a43c72847053eb4393f7d9314f77d6
- MD5 SHA1 SHA512
Xenos/resolvers/resolve.dll
- SHA256 3ca2077da08f52482fbc6e2f2eb17ed8f4b2733e3f5c6aa3eb36d328b370f299
- MD5 066afdeeeef62a9be4d462162ea5aaaa
- SHA1 29b35f823420eea86b72751d2ee8dda846399289
- SHA512 6485ab56f287a9ecd0e7fc370eacd74ad42dc2a750d8a09f8357e98b966551c229f643d7a0b6499413025e28a8ac60f068832a5a1c95a1267d246f62e8c254d2
- SSDEEP 3072:5Zj2Wz02Pkwby20qZ8UD3BaouUOpVBO78ztPxPNEpNwi:5ZyWNaE85ouLc8ztcyi
- TLSH T13DE312A8FA84709CF3379D2AEF0C33CAF4AA4E4B91A242F77B050B385341A6D0506597
- MD5 SHA1 SHA512 SSDEEP TLSH