General
- Target Xeno_v1.3.54205_tUuKD4.zip
- Size 2.3MB
- Sample260712-ae4ppabs7k
- SHA256 6e75fd69288d63e30c5707a48b31058ec4bfbc56aeda69c1e4342cebdad07695
- MD5 e8f4f309d8e2b6b100a3f597fe6f795b
- SHA1 d552dc1c7009d031d97eba3d91685b0902b9debd
- SHA512 3a896bfb3d94cf87034215f01b3e3e4b98d19e3dbabb535d57379a49b7d16a4b27127247806aade175bef7d57cf5ac0ab0b0e55a8bf098cf2427d80f08c5ebf4
- SSDEEP 49152:0cdBGubKOJG8lc9Sj6tg0hT6zmwim9QO7xmhL/580bBCLrEH:0ONE8/WtdrwiUQO1sx80j
- TLSH T17DB5337514308921B21EAE22EF0A7EC4CCD91C9717598BE6C967F36F219A9017EF231D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno.exe
Resource
win11-20260513-en
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
mpclient.dll
Resource
win11-20260513-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target Xeno.exe
- Size 683KB
- SHA256 715b4174065916a6412f60b3c10664b323dc737fd717ab09627083be34626fe0
- MD5 6669e10c960f6c2297bcd3d5a27412aa
- SHA1 73bee544b24312d0057d9ce5e62daa9f73243d00
- SHA512 feb1e93aed3f1a0ade6e6ab169af46ddd438aa80f6667fb24421d2f0b7da1c4a4902438421079a75eecfc9a3347c3ebe7f62b88ea9e67a9c951954d8555ea497
- SSDEEP 12288:tiGbyLR32C4NHhZoLCZcvDaLgf5pB6Nwi5//E7soazN0uahRg:MGboR3P4NHboLCevWLGL6//E7sTN0hhC
- TLSH T1ECE48E2AB3E401F9D1B7D276C9535A26FB71780A1731CBCF03A046562F276A49E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score5/10-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target mpclient.dll
- Size 4.2MB
- SHA256 a7d5893e8f7eb0748712571732a5aa056ca019d03518ce9ffc97cc24f947c8a2
- MD5 da9b87eed5b238f7ecf556effdc262ab
- SHA1 faf4bbea8e7db64f89416d641c5915274ac189fc
- SHA512 3769c6727b709b13c14cb20b936242579cb911cc6db5cebd1352b12572fe72f6f66b03b9f495c1fcb4b55bebdd61b06426a2734c179029a48137d2779a48ae22
- SSDEEP 49152:oDlbFLIZm8btLolSL/0nL/4G7Okiw33OVTllC2TYqH3+qYB9aDVl:oTy527nj4y3OVTHNH3+ODVl
- TLSH T12B168D47BF942968C0DDA331A86602693B3CBC0D8F7323EB2E5176362EB23D15975B54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Suspicious use of NtSetInformationThreadHideFromDebugger