8c2076c7af332c8cbe86498037a32a3ef9c7257a71b9c874ff984d677d69e289

General

Target
Xeno-v1.3.57.exe
Size 42.2MB
Sample260718-l18fjsfw8r
SHA256 8c2076c7af332c8cbe86498037a32a3ef9c7257a71b9c874ff984d677d69e289
MD5 e7e36840b34d758ec89fce17ae7c0eda
SHA1 4ceb4e29c11b5530369edb107ec921ed415e0c3d
SHA512 6f3833f284efeeb5ce0a2e27d92338625cd44355060923e252a9d974ecfa43a5935cc87148c8e0fa1f91177e0b4d76fd738a0d8a43a89583f40af672e178f4fc
SSDEEP 49152:xVsvYhQz3dcYDWhvZzyJNfwoqkSejP0+6NiwI57RRaBxMaOp:IvYhQztcEYyJdwoqk3s9krNv
TLSH
T185A702CDDF449D4CED9D02B840A9428475F4BCB69356F28BA9F738F839B924EE4460C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Xeno-v1.3.57.exe
- Size 42.2MB
- SHA256 8c2076c7af332c8cbe86498037a32a3ef9c7257a71b9c874ff984d677d69e289
- MD5 e7e36840b34d758ec89fce17ae7c0eda
- SHA1 4ceb4e29c11b5530369edb107ec921ed415e0c3d
- SHA512 6f3833f284efeeb5ce0a2e27d92338625cd44355060923e252a9d974ecfa43a5935cc87148c8e0fa1f91177e0b4d76fd738a0d8a43a89583f40af672e178f4fc
- SSDEEP 49152:xVsvYhQz3dcYDWhvZzyJNfwoqkSejP0+6NiwI57RRaBxMaOp:IvYhQztcEYyJdwoqk3s9krNv
- TLSH
  T185A702CDDF449D4CED9D02B840A9428475F4BCB69356F28BA9F738F839B924EE4460C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection costura discovery execution packer persistence privilege_escalation spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2