XeniteOG_1[.]rar | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
XeniteOG_1.rar
Size 2.6MB
Sample260804-nk91jsac94
SHA256 7dfd7fcb9fb1642c1af8d82e33c7547d0bb663eb3bc04c5832c29ab8bcee8c30
MD5 3d542d9d2382219bf117cf30fa1acfee
SHA1 b0913a0b0d23ad32739a513dd9499962ba4b4288
SHA512 a1951e3ef063fe84aaf83f79a5745577abb227271500420c917b3d1bb800e2a2c7d1dcc8df5f7b63f07d8b576408102e8c0dc5056d56df36980faff3b685fead
SSDEEP 49152:3kUcKoBqd7W0CfwdkokFAf9XvwQheHkPmL+vaXnzvvjFtnAEQSSGkNNt:3kUcKoBqd7W0CYdkok6vwQkHT3RtfBML
TLSH
T189D53334A770807FF80443BB2E134DE87F19DB97A48D96AC23219C316B9DAC2595267F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Xenite OG.exe

File Explorer

XeniteOG_1.rar

.rar 2.6MB
Xenite OG.exe

.exe 2.9MB

XeniteOG_1.rar

SHA256 7dfd7fcb9fb1642c1af8d82e33c7547d0bb663eb3bc04c5832c29ab8bcee8c30
MD5 3d542d9d2382219bf117cf30fa1acfee
SHA1 b0913a0b0d23ad32739a513dd9499962ba4b4288
SHA512 a1951e3ef063fe84aaf83f79a5745577abb227271500420c917b3d1bb800e2a2c7d1dcc8df5f7b63f07d8b576408102e8c0dc5056d56df36980faff3b685fead
SSDEEP 49152:3kUcKoBqd7W0CfwdkokFAf9XvwQheHkPmL+vaXnzvvjFtnAEQSSGkNNt:3kUcKoBqd7W0CYdkok6vwQkHT3RtfBML
TLSH
T189D53334A770807FF80443BB2E134DE87F19DB97A48D96AC23219C316B9DAC2595267F
MD5 SHA1 SHA512 SSDEEP TLSH

Xenite OG.exe

IMPHASH 7a8c872f8e13d32f36a675b52eda1d6e
SHA256 26cb685db18ca8a4ec609cf137bb288d554678f68c2a13c5037bee9c9f9d9ee4
MD5 efff2e91e26a5c894ad1ef20349b1f16
SHA1 babe5432f5b11f4dd2808cc23f193537014be881
SHA512 92014adce8a0b7f8bb722381a248ffe3f392c5ae56ae5b1688bd1ccbf42ad99e1f67386150715daf3e7f9023be613be6871997b29667bbf700b8a3fe3284b96d
SSDEEP 49152:9KFOU1aDVwplohcWnw0mGQACEPMzNBG9t7t600QBwrNU/CAByLQQimN:9KIU1a7wN5MWNBGLE00QBwrNWrwMGN
TLSH
T139D5122DE6B04E53D6691D7AC0A3041297B1F6456B33E7CF37741BA22E133A49E723A4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

75232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

shell32

ShellExecuteW

advapi32

RegCloseKey ReportEventW RegisterEventSourceW RegOpenKeyExW RegGetValueW DeregisterEventSource

kernel32

GetSystemTimeAsFileTime TlsFree CreateActCtxW ActivateActCtx GetLastError FindResourceW GetWindowsDirectoryW GetProcAddress GetModuleHandleW FreeLibrary LoadLibraryExW FindFirstFileExW EnterCriticalSection GetFullPathNameW FindNextFileW GetCurrentProcess GetStdHandle GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection GetEnvironmentVariableW FindClose MultiByteToWideChar GetConsoleMode GetFileAttributesExW LoadLibraryA WriteConsoleW DeleteCriticalSection WideCharToMultiByte IsWow64Process OutputDebugStringW TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW SwitchToThread GetCurrentThreadId InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter

user32

MessageBoxW

api-ms-win-crt-runtime-l1-1-0

terminate _register_thread_local_exe_atexit_callback _c_exit __p___wargv __p___argc _exit exit _initterm_e _errno _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table abort _invoke_watson

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc malloc _callnewh free

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64_s wcsftime

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfwprintf __p__commode fputwc __acrt_iob_func __stdio_common_vswprintf _set_fmode _wfsopen fflush setvbuf __stdio_common_vsnwprintf_s

api-ms-win-crt-locale-l1-1-0

_create_locale ___mb_cur_max_func ___lc_codepage_func ___lc_locale_name_func __pctype_func _configthreadlocale setlocale _lock_locales _free_locale _unlock_locales

api-ms-win-crt-string-l1-1-0

strlen strcmp wcsncmp toupper strcpy_s _wcsdup wcsnlen

api-ms-win-crt-convert-l1-1-0

_wtoi wcstoul

api-ms-win-crt-math-l1-1-0

__setusermatherr