e8ea6ee3a8936390ca866af0340c8512df663bd7ffc71407ee01cb021dbbcf36

Sharing

Copy URL Twitter E-mail

General

Target
Xeno-v1.3.60.zip
Size 6.8MB
Sample260806-m2fmlatthv
SHA256 e8ea6ee3a8936390ca866af0340c8512df663bd7ffc71407ee01cb021dbbcf36
MD5 c8426d98b2d7521a9a21775da525a608
SHA1 7484351e39d6611b512a7e7362ad2a6970d918dc
SHA512 e075a9b9731a0a51d93a50e8cddc0649ddba16f114230fc944a92b0ee1d9b62481ea1e8f2339943fbd4ce51a16c3e1a2b502c9a21dfe54524309f7806a71ef3a
SSDEEP 196608:MpF20v3bGBvG7bM0Y2XaCzC/s+528kgAjJ5wop0IKBA8MW:MpFzv3b/nMkhZ8kgoFp0xG8MW
TLSH
T11976334C66FC18D2FA3492BC1D351AE4B593B7467611A813AA4808E736EBDC05B53F2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  Xeno-v1.3.60.zip
- Size 6.8MB
- SHA256 e8ea6ee3a8936390ca866af0340c8512df663bd7ffc71407ee01cb021dbbcf36
- MD5 c8426d98b2d7521a9a21775da525a608
- SHA1 7484351e39d6611b512a7e7362ad2a6970d918dc
- SHA512 e075a9b9731a0a51d93a50e8cddc0649ddba16f114230fc944a92b0ee1d9b62481ea1e8f2339943fbd4ce51a16c3e1a2b502c9a21dfe54524309f7806a71ef3a
- SSDEEP 196608:MpF20v3bGBvG7bM0Y2XaCzC/s+528kgAjJ5wop0IKBA8MW:MpFzv3b/nMkhZ8kgoFp0xG8MW
- TLSH
  T11976334C66FC18D2FA3492BC1D351AE4B593B7467611A813AA4808E736EBDC05B53F2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Xeno-v1.3.60/Microsoft.Web.WebView2.Core.dll
- Size 557KB
- SHA256 11e88b2ca921e5c88f64567f11bd83cbc396c10365d40972f3359fcc7965d197
- MD5 b037ca44fd19b8eedb6d5b9de3e48469
- SHA1 1f328389c62cf673b3de97e1869c139d2543494e
- SHA512 fa89ab3347fd57486cf3064ad164574f70e2c2b77c382785479bfd5ab50caa0881de3c2763a0932feac2faaf09479ef699a04ba202866dc7e92640246ba9598b
- SSDEEP 12288:6CxswUBor35JrpQ322zy+uFKcDoRFNCMmeA+imQ269pRFZNIEJdIEY0lxEIPrEIE:6Cbmv
- TLSH
  T15BC4402123FD8A1AE6F63BB5A57407709BFAFC967979D39D0598251C0D72B408AE0333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Xeno-v1.3.60/Microsoft.Web.WebView2.WinForms.dll
- Size 37KB
- SHA256 5696366f7458da940cc986dc5d3d4549a2368512acd769014ecbb07b47bd88b4
- MD5 8153423918c8cbf54b44acec01f1d6c2
- SHA1 f0c3c5412b809725e6d4809230adb15cc7d83ad2
- SHA512 f3dc771e37c71479d332142ec5a9c5c3f39ca71937f595a0f7482ae5aaaafd92e932efc9b0363d4511d547f3c8b2e0497ebbf8356e7d07fc344f4e5715b0ee87
- SSDEEP 768:1sjCEEHJ9l0EeFZ2sxIHzttZDgcEST3p4Jjrjh2jJ+SG2au8vxJKia5/Zi/ZGQKk:wCEB15azttZDgcEST3p4JjrjaJ+SG2a/
- TLSH
  T1B4034B0483DCC617D6EB6FB8A5B491620B7ABF837960D36D1C84F5E90DB37A0891076B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Xeno-v1.3.60/Microsoft.Web.WebView2.Wpf.dll
- Size 50KB
- SHA256 b628d6133bf57b7482a49aa158e45b078df73ee7d33137ac1336d24ac67ed1b4
- MD5 4a292c5c2abf1aab91dee8eecafe0ab6
- SHA1 369e788108e5fb0608a803fa2e5a06690b4464b5
- SHA512 ca22adfff9789730e4c02343e320d80b8466cfc5a15f662cefe376b7ee29dea571004c1c26cd3f50c0d24e646f2b36b53fa86835678f46f335d65eec52431cde
- SSDEEP 1536:gpGhWMhWLF9jwKi8LDP/ryEH0GBy4JjrD1aah/UaOzk6hKKa5/Bi/IGCv0Z0T6Cc:taBi8LDP/b0GBy4JjrD1aah/UaOzk6hz
- TLSH
  T12E33398047AD8533D6EF4FB450B481214B79BE83B9B1E78A1DC8F4E91DA77800A543AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Xeno-v1.3.60/Newtonsoft.Json.dll
- Size 695KB
- SHA256 22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07
- MD5 adf3e3eecde20b7c9661e9c47106a14a
- SHA1 f3130f7fd4b414b5aec04eb87ed800eb84dd2154
- SHA512 6a644bfd4544950ed2d39190393b716c8314f551488380ec8bd35b5062aa143342dfd145e92e3b6b81e80285cac108d201b6bbd160cb768dc002c49f4c603c0b
- SSDEEP 12288:mFIM0KteTMN4Or4D3OdmZg5WHEaEDIGBBjgrIQtD+tVqDMW:6zMTMNNd+g5Wk78GBBjgrIQtDF
- TLSH
  T165E45A2123E99B2BE0AF2775B032491647FAF542F6B7D78F5604D8AA1C43F558D82323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Xeno-v1.3.60/ReadMe.txt
- Size 624B
- SHA256 6a94cae4f1646434effdba50e97df702f84c555c8a3ca3d6b1363d74ba1d7264
- MD5 46e780332fd001710fb283ceec2dae3a
- SHA1 029159c0adbf13de9d4ff03ef5dfc8d7c5c6aa48
- SHA512 8e87a34c459bd42a1b3096cfa2572edd8ce834f212863eb64af2bff89386c92d85f8b3558930b3b6f4bb2094a7fe38d43526ccbca834854e79a18b5afa25bf53
- TLSH
  T197F0022FCB87935255A032C556084244E71B17AF0F59CAED01AA46EC310F1CAC0F59FB
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Xeno-v1.3.60/WebView2Loader.dll
- Size 161KB
- SHA256 465a7ddfb3a0da4c3965daf2ad6ac7548513f42329b58aebc337311c10ea0a6f
- MD5 c5f0c46e91f354c58ecec864614157d7
- SHA1 cb6f85c0b716b4fc3810deb3eb9053beb07e803c
- SHA512 287756078aa08130907bd8601b957e9e006cef9f5c6765df25cfaa64ddd0fff7d92ffa11f10a00a4028687f3220efda8c64008dbcf205bedae5da296e3896e91
- SSDEEP 3072:7evoTTlTRTyiuPThTNTKm81SbbMYSPLNsknZiZ2HZ5AaliiT88FEtJ57dXSvlCW:HTlTRTyiuPThTNTKmFQdhsknZiMHfEti
- TLSH
  T120F36C5B72E4407BE16B8274C9A34A11E77778110B60ABEF03A447791F237D4AE3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Xeno-v1.3.60/Xeno.dll
- Size 2.3MB
- SHA256 548bc003d52e694b6176b3fb5595fddf07ccecb685eb712c730dc657b382fd48
- MD5 3139b471779a494d4680d9a0515b3459
- SHA1 2f67cb31ecbfb7c275251290818933e33507bdf6
- SHA512 e21406a945fa4664119c3303a084ed5af5cc738fee2d4d6f376898cfb537ce6355266a3ce12712a187e917c511924c75c57c19591459b3884758c16b8f403f3a
- SSDEEP 49152:q+jqPOu2DM1P8daBpcU5TgySscBxFkUXDBIhm1R:ce8/WbTFhDDP
- TLSH
  T18CB58E67A59900ECD076D1F88A1B5513E7B27C4903306AEB02E0B9652F27BF58F3EB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  Xeno-v1.3.60/Xeno.exe
- Size 160KB
- SHA256 aa2818266e03c443f4f6480f552cfc330fa74d5164a4244e4bccab4f3efae715
- MD5 ea47d036d690aee0d3e8b87fb2056ac0
- SHA1 63cadbb8b0e5047132271960881d2e3da8a28da9
- SHA512 88c81f6ec1912cd71de04a3225084b0c1248be0f8f5ab6681414600bc49068b2f341b465a4009e13bfd6d5150897bf3d8cf83900971540574aa794f702ead877
- SSDEEP 3072:CqeXA/4yIg9vkNPNu6H6xCYOiVUE265AJwizR:CvgvkNFNaxmNEgJdR
- TLSH
  T134F34B07A6A850BDE1B7C678C9924D41FB727C598B71A6CF03507AB60E737D0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral16 behavioral17
- Target
  Xeno-v1.3.60/Xeno.exp
- Size 1KB
- SHA256 b29565ca546538917a4017a430e2f6b0254395e7d5d3235395453f88174bd87b
- MD5 2aae7de1c949d1bbe8662d5d3a0b33c3
- SHA1 8280b99d182f678016c54bc618cae7ed0a0e93d0
- SHA512 604622fb532ae09e6785a9ee0d2faa7851bff6888f8f567bf9013feffae5da7e40dbe863084107c95737b4dbee5d0880fe2cf314165fbbb24a6f38d47e292ebe
- TLSH
  T1DB21CE019BC09D12F1045D38D2D6A70AF7F3FE829787431E5BC4811B2D8B7C6A254822
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  Xeno-v1.3.60/Xeno.lib
- Size 2KB
- SHA256 17435aadcba87c4f30736ead7e38c23fb9576df7053ee6ea64aefdd637b7cdf2
- MD5 c7cf20e7ba05b36ce4c8afd84ca50687
- SHA1 c184b463d96b6acfe62a54b780e7a860f103fb15
- SHA512 6de043a604ba360f6346df9ec649696ab648b0bb9b1d58899dd489ef720171571471236f17f4bec53fdb84654d521df5641cfc64dd5cd93433936c00a466032b
- TLSH
  T13F51CE37D5D65E2BD32CC1B9C042A89D227C654A2303AF7F39AD14E14779B98E351C46
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  Xeno-v1.3.60/XenoUI.deps.json
- Size 2KB
- SHA256 7ff9c9f6cb3abc82fb609bac087fcfb31b3e86dba3298f2074a04f35c7b1200f
- MD5 52092b9130fdf7a54794e587a8cef160
- SHA1 da6ae384a5fe9f35147a61a162acdc1125318d75
- SHA512 a4683ad14691fe750aa8ee6005725d46b5bddc3dc8ef3ffed465a19f779d7e9dbb8bc516fc5a3ed705f09207a86ccfe6bdd1f76ffd44bcb3cb3a5b1fd8c6b6b2
- TLSH
  T161514515E9804EA748B02BFA657943C9F721136F6002594BB8BD289CCFB7F766581F38
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  Xeno-v1.3.60/XenoUI.dll
- Size 145KB
- SHA256 df0340b85421ca26bb402298a0be16b256717ab5a50bc5fced8def1775935b28
- MD5 ae10fbd713d66bb20ee8b62195acdfc3
- SHA1 361d03203b859be7bcf38442338b550972bffefb
- SHA512 098f81334f3933c20a75be58b150516775e6116e91d47a39f45eb55aaf7af20871cf39b74accf1279a60e2c77682e082e32e185a23c9d154c97c04dd837962c0
- SSDEEP 3072:g1gdAO0a8Uwz2TbyG3BOZB7Pby6SgV9Sj0LC55dVPOdXmqTc7:TAnaCz2HyGkFby6p9Sj0Uh2dWb7
- TLSH
  T1BEE3AF41376CCA12CABF0FBD64B152955A71BE17A5A3E70E14CC349C6CF738286523AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  Xeno-v1.3.60/XenoUI.pdb
- Size 43KB
- SHA256 2cdee00118695abaf73bf67e708c32deecabb9cfc0d0f7f5b5e89be0a144a897
- MD5 1c4542c9575574544d0a2385f71f451f
- SHA1 8c8b3491b3cbcb7e76546456f423531b7383c24d
- SHA512 ee4c57d837b284687adca84978c80c3c81b20d708abad530cc6864cb337162f2bd2b7fa02414355da4b9c2eb92697c62b7c6a2148ae8e5d89a84d5daf3573e9b
- SSDEEP 768:3RRwlmQva+a9XjtgMCOdTnWCd7NFfRuFft7Fd1WeCuY6JxKbnSs7G2MTnoVp:3Hwlk1yMCOhv7Df8jvWejpK2MLMTe
- TLSH
  T193136A3B9388D725C6161476683BC34C7730C3286742EF32F1E66A28EDAF74917B6260
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  Xeno-v1.3.60/XenoUI.runtimeconfig.json
- Size 429B
- SHA256 73b37384bb001e78db2014d328750eb2990393712fd63cd00c0f41965b3dbe96
- MD5 1043e1e5e960609d014e56f638202c24
- SHA1 aaa1583e8c9809a39a52c73efff1e5e439cfd3df
- SHA512 5fe61affcddd7b6235270cc3f0e7fa7f2e890852de6f5c7759234870d244ee1b32f95dfd7efb5e2f410d12557593491c53a5323b68966918f92a545c1f10d66e
- TLSH
  T1BEE02A3ACA206DB714F02BBEC02AC187FA3023AB00040D16BAFC180C2F361A22001F88
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  Xeno-v1.3.60/api-ms-win-crt-convert-l1-1-0.dll
- Size 15KB
- SHA256 94b6e91b93c2202dabd659bff294bee87c22897a30a6b4930b49051c2fb502dc
- MD5 c8dbf0ca88facfe87899168a7f7db52c
- SHA1 e2cf163ad067b5d3b19908a71ed393711f66cd09
- SHA512 e85c738f5d5a0ae6c3ef75a082712cb3cf2feae4560d316cb110e4eaf3a97d6058d5374da2a5edde39c3114f9aff8a027cbdff8cf49be2425943bac09c39e70b
- SSDEEP 192:w89M0wd8dc9cy1WphWWD1S8f4DBQABJt9o0Z5uE7Mqnajcno:wt0wd8xy1WphWWD1IDBRJtO0zuOMlAo
- TLSH
  T1A762A49366E43F15EA9F277221FEDBD72A391B81255043B8C607E54C3882782BD97C0E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  Xeno-v1.3.60/api-ms-win-crt-environment-l1-1-0.dll
- Size 18KB
- SHA256 f7c6c7ea22edd2f8bd07aa5b33cbce862ef1dcdc2226eb130e0018e02ff91dc1
- MD5 c712515d052a385991d30b9c6afc767f
- SHA1 9a4818897251cacb7fe1c6fe1be3e854985186ad
- SHA512 b7d1e22a169c3869aa7c7c749925a031e8bdd94c2531c6ffe9dae3b3cd9a2ee1409ca26824c4e720be859de3d4b2af637dd60308c023b4774d47afe13284dcd2
- SSDEEP 192:sfW1hWiQcvHCjdks/nGfe4pBjSY6Na3sAW5RKTt3E2sVWQ4GWIjcyqnaj/6g6dqd:sfW1hWPQim0GftpBjzim3StltFpn
- TLSH
  T1F2822BC69ABC9543F9C3AE7052B8EA877D3DDBC31D20812605A9F5982CC73D1EB1092D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  Xeno-v1.3.60/api-ms-win-crt-filesystem-l1-1-0.dll
- Size 13KB
- SHA256 51541ec6684b43157a85ea46a42ebed4555be06bed0d0d07ff3ea6377301318d
- MD5 42a2a95f1bb940d01f55eb1674a81fe2
- SHA1 f982f3bbb4dc3aaaba8df098d1b395846f7cba08
- SHA512 de9a7a1a6a45e2f76105eaeafcc3c29adbff142dcf2586e147417045b897a9dcddec5e1b97acfc5d3fc9c8e3a508dbc3f607bf3df20a7435e74436f94cb056b6
- SSDEEP 192:zt/PGnWlC0i5C9WphWAeD1S8f4DBQABJJ2yy2D8KN3qnajV2MVorr:VunWm5C9WphWbD1IDBRJJkt2lxnorr
- TLSH
  T18852F78347E47E02EAA72B3112FDDBDB3F3D5781185247668006A52839E73C1BF1659D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks whether UAC is enabled

Contacts third-party web service commonly abused for C2

Network Share Discovery

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32