1e698603db3e499ba58c340d131be769d24cb02602187b0149a4ffc24890d67f

General

Target
Xeno-v1.3.50.exe
Size 83.0MB
Sample260717-bv61eshs6q
SHA256 1e698603db3e499ba58c340d131be769d24cb02602187b0149a4ffc24890d67f
MD5 11b87e740c77a0cb92db6d0530a510ba
SHA1 94ce23b822f5c945f3e130d062cb783efce3e853
SHA512 541fcb6c5d9d69562d3061257043d155d5a3a73507434806731c731a461dc5a1c1cfef68562e6330a85866d4ea1a6ba53b4efbd8ed70791c51f90a0377f53227
SSDEEP 196608:GUf0fSDgsATvQ7OCW627QWA79nclG3vV/OjmFZ3RxtYSHdKukdai7bN3mD+PxThf:GUfoS0smcOC8MWASovAK5p4B3Qy5N2i
TLSH
T1DE1833106E992CBECAF88239E0AF5E195BB15F81854DD2EF03D454C36B5FF91483B829
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Xeno-v1.3.50.exe
- Size 83.0MB
- SHA256 1e698603db3e499ba58c340d131be769d24cb02602187b0149a4ffc24890d67f
- MD5 11b87e740c77a0cb92db6d0530a510ba
- SHA1 94ce23b822f5c945f3e130d062cb783efce3e853
- SHA512 541fcb6c5d9d69562d3061257043d155d5a3a73507434806731c731a461dc5a1c1cfef68562e6330a85866d4ea1a6ba53b4efbd8ed70791c51f90a0377f53227
- SSDEEP 196608:GUf0fSDgsATvQ7OCW627QWA79nclG3vV/OjmFZ3RxtYSHdKukdai7bN3mD+PxThf:GUfoS0smcOC8MWASovAK5p4B3Qy5N2i
- TLSH
  T1DE1833106E992CBECAF88239E0AF5E195BB15F81854DD2EF03D454C36B5FF91483B829
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer upx
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VirtualBox drivers on disk
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Looks for VMWare drivers on disk
  defense_evasion
- Modifies Windows Firewall
  defense_evasion
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
  Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
  defense_evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2