42755d7735ab3eabc7fac074eb5e631212f4df02c6de60ec8de4af4b1b39f913

General

Target
Xeno-v1.3.60.zip
Size 6.8MB
Sample260815-cht1rsdc78
SHA256 42755d7735ab3eabc7fac074eb5e631212f4df02c6de60ec8de4af4b1b39f913
MD5 fbe8154d51b06173ecb2f2d009d58eb3
SHA1 44fdc7f32ea4474c7142d1d541a8ee472fa68ef5
SHA512 d37415fcae697972c49400841297ec4f9826b5d37faadf5b6daaae586a0a7996ef4e47f0a9f3152165de1032156b6fc15551681778d99022d54f6925066e5ae5
SSDEEP 196608:ApFx0v3bGBvG7bM0Y2XaCzC/s+528kgAjJdcABwP:ApFKv3b/nMkhZ8kgAKP
TLSH
T17576338CAAFC05E3FB3441B869615EF4B257B3846A42A507D988049761AEDD04FC3B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Xeno-v1.3.60/Xeno.dll
- Size 2.3MB
- SHA256 9d16d62878486d6caad6536c702de88165d2b07aaf124dd090559fbc424b3a3d
- MD5 9fcd0650519b5e5265fe5f07eb894c31
- SHA1 f531ff4b7eccd8a3caf31dc7ce35694de76e8cbf
- SHA512 fb2dad25e02f074c12bc49262aea08c4c2baf0ffc4280366eab2f890881526b134716bbf7174505730c6cfd40b2d9b050a5694a0d0cb670b857a201be8bc2b49
- SSDEEP 49152:h+jqPOu2DM1P8daBpcU5TgySscBxFkUXDBIKm1X:he8/WbTFhDe9
- TLSH
  T1C4B58E67A59900ECD076D1F88A1B5513E7B27C4903306AEB02E0B9652F27BF58F3EB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Xeno-v1.3.60/Xeno.exe
- Size 164KB
- SHA256 ae6fc5ba07dc314423a518f93b8ad69a5730df780669fd3b40283c32b24a56fc
- MD5 6156707c90644ea4edb71f3044d1c8d9
- SHA1 237a4262696840719021a53e9322ca1fd0d6fb0d
- SHA512 8fc14005a4ec1cc372e7be1d64c12899a9f304f6002ef1c87bf510697c3ee9fb8753a042e6d2ef5dde6805f349b96847f09a19ab0fa5385ea7e7ee915054d13d
- SSDEEP 3072:520jWfVKLer59aSpfO9D/87jXEkeFZA4nsSyU3i4w:MIhSpfO9jC/44Uhw
- TLSH
  T189F34B07A6A840BEE1B7D679C9924941FB723C558B71A6CF03507AB60F777D0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Xeno-v1.3.60/XenoUI.dll
- Size 145KB
- SHA256 6e5ddbf5d1a9f963cf0bc9bd459dcff983e95704abd5cb1c582365f3eadb2ebc
- MD5 d4ae28d2b6115d75d8ec2df06d9852c9
- SHA1 3a4e82abde784aa261ea760f0a8bb34eb95eb403
- SHA512 b6c041079f31acd92d0007c43c8a93317c3a917817eef48ba9c42d6456d11c9eb8a2cbf6f130b358613e894a3e999c916cab27fc5077407f416364c8aa0efddd
- SSDEEP 3072:iBMd4YOG6EEaScUrlc2TbyG3FC8Z7Pby6SgV9Sj0LC55dVPOdX0VTbO:x4tr22HyGt9by6p9Sj0Uh2dk5O
- TLSH
  T129E3B041376C8A22CABF0FBD64B652955A71BF16A563E70E14CC349C6CF7382864236F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6