Downloads[.]rar | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Downloads.rar
Size 945KB
Sample260720-tvycdsf18m
SHA256 97550c22d6b827ede537379629b96a233b138b46c1ca2db4c95d48974400a67a
MD5 411751551d92b2df19451793991ff39c
SHA1 20110ddbb6b72edc1325514e200e3c37d4763958
SHA512 74eee0b70b6a386ddad108137ecbcb7141b90890ed6961e7534c0057bc6160158f141887f6bef8b40a13391d2ea145030bc11e36474b38246cd9483b2a536f4d
SSDEEP 24576:dEoo5c7OI/pCoSmIJUWYitlTkRepyiPiRgZ4CSVVwYIl9Hj:dEd5c7VpCoSmyHkRKRaSWVV7Il9Hj
TLSH
T1ED2533DA9162313479714422EB76A093B45032BAE145F2E0BB04D39C91B1EFBB37726F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Xeno_Cracked.exe

File Explorer

Downloads.rar

.rar 945KB
Xeno_Cracked.exe

.exe 2.0MB
Xeno_FakeAuth_Server.ps1

.ps1 4KB
add_hosts_entry.ps1

.ps1 355B

Downloads.rar

SHA256 97550c22d6b827ede537379629b96a233b138b46c1ca2db4c95d48974400a67a
MD5 411751551d92b2df19451793991ff39c
SHA1 20110ddbb6b72edc1325514e200e3c37d4763958
SHA512 74eee0b70b6a386ddad108137ecbcb7141b90890ed6961e7534c0057bc6160158f141887f6bef8b40a13391d2ea145030bc11e36474b38246cd9483b2a536f4d
SSDEEP 24576:dEoo5c7OI/pCoSmIJUWYitlTkRepyiPiRgZ4CSVVwYIl9Hj:dEd5c7VpCoSmyHkRKRaSWVV7Il9Hj
TLSH
T1ED2533DA9162313479714422EB76A093B45032BAE145F2E0BB04D39C91B1EFBB37726F
MD5 SHA1 SHA512 SSDEEP TLSH

Xeno_Cracked.exe

IMPHASH 2ad49a4e47f24204f0fd93744f660a8a
SHA256 1de6513b8ca27d582f51e16a1391d2168be276a46d9e8298d853b556f167f48e
MD5 809049554983a275ce1958829311c172
SHA1 77227454d807122b5409a3441da119e376c8e623
SHA512 0b21455660d6fd70823fdcfd3edfe2b9f8cc2f000b50fd55ff5ec91157c7b7facd772b7d7c9bd1664a9b9a1b18bbc1a275f549c586c5a008b8dc228b4908ad8e
SSDEEP 49152:M4C0ho3o63qTA2mDTJ6uqeg9kiQAUS/c76UisK9xrqAnfKWr:6kuqeg9kiQAUS/c7Wj9dWW
TLSH
T13F95C056B7B501FCC167C03CC696D61BE7317818172096EF33E08AA92F63BE11ABA751
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1237704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

kernel32

QueryFullProcessImageNameW SetDllDirectoryW SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection LocalFree LoadLibraryW SleepEx GetSystemInfo GetTickCount MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx AddDllDirectory SleepConditionVariableSRW GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx GetModuleFileNameW WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent OutputDebugStringW GetModuleFileNameA UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualProtect GetSystemDirectoryW GetTickCount64 GetCurrentThreadId CreateThread GetLastError GetFileAttributesA QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar lstrcmpiW CreateDirectoryA CreateRemoteThread GetModuleHandleW VirtualAllocEx GetCurrentProcessId GetCurrentProcess DeleteCriticalSection InitializeCriticalSectionEx SetDefaultDllDirectories GetProcessHeap HeapSize AddVectoredExceptionHandler HeapFree HeapReAlloc HeapAlloc FormatMessageA GetLocaleInfoEx HeapDestroy WriteProcessMemory DeviceIoControl CreateFileW OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW Process32FirstW CloseHandle

user32

DispatchMessageW SetForegroundWindow GetAsyncKeyState ShowWindow RegisterClassExW GetSystemMetrics CreateWindowExW DefWindowProcW GetWindowLongW SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard PeekMessageW SetLayeredWindowAttributes SetWindowLongW IsWindowUnicode GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient GetCursorPos MessageBoxA GetMessageExtraInfo PostQuitMessage SetCursorPos TranslateMessage GetKeyState ReleaseCapture UpdateWindow

advapi32

ConvertSidToStringSidA AddAccessAllowedAce GetLengthSid GetTokenInformation InitializeAcl IsValidSid RegCreateKeyExA RegDeleteKeyA SetSecurityInfo CopySid CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 OpenProcessToken

shell32

ShellExecuteA

msvcp140

?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ _Xtime_get_ticks _Query_perf_counter _Query_perf_frequency _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?_Xbad_function_call@std@@YAXXZ ?_Random_device@std@@YAIXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CertFreeCertificateChainEngine CryptStringToBinaryW PFXImportCertStore CertOpenStore CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CryptDecodeObjectEx

ws2_32

ntohl WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError ntohs WSASetLastError WSAStartup WSACleanup bind connect getpeername getsockname htons recv getaddrinfo setsockopt freeaddrinfo inet_pton inet_ntop getsockopt send socket WSAIoctl WSACloseEvent WSACreateEvent __WSAFDIsSet gethostname select ioctlsocket sendto accept recvfrom htonl listen WSAEnumNetworkEvents

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

wintrust

WinVerifyTrust

dnsapi

DnsFree DnsQuery_A

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __C_specific_handler __current_exception wcschr strrchr memset __std_exception_destroy __std_exception_copy strstr strchr __std_terminate _CxxThrowException memchr memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

system _seh_filter_exe _set_app_type terminate _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e _exit _errno __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _beginthreadex __sys_errlist _invoke_watson _initialize_onexit_table _register_onexit_function _crt_atexit abort _invalid_parameter_noinfo _resetstkoflw exit __sys_nerr

api-ms-win-crt-stdio-l1-1-0

_close _fileno fwrite _set_fmode fputs __stdio_common_vsprintf fgetpos _wopen fflush _write ftell _read setvbuf ungetc __p__commode fclose fsetpos fread __stdio_common_vsscanf _fseeki64 fseek fgetc _lseeki64 _popen _pclose fgets _get_stream_buffer_pointers __acrt_iob_func __stdio_common_vfprintf _wfopen feof fputc

api-ms-win-crt-heap-l1-1-0

_callnewh calloc free realloc malloc _set_new_mode

api-ms-win-crt-convert-l1-1-0

strtol strtoull strtod atoi strtof strtoul strtoll wcstombs

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _fstat64 remove _unlink _wstat64 _lock_file

api-ms-win-crt-math-l1-1-0

_dsign pow powf sin sinf ldexp sqrt sqrtf _dclass fmaxf _fdclass roundf acosf asin atan2 _fdopen ceilf cos cosf floorf fmodf __setusermatherr tanf atan2f

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-string-l1-1-0

isspace tolower _stricmp wcsncmp strcmp isxdigit wcslen _wcsdup _strdup strspn strcspn wcspbrk strlen strncmp strpbrk strncpy towlower wcsncpy

api-ms-win-crt-environment-l1-1-0

getenv _dupenv_s

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64 strftime _localtime64

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func