Overview

overview

10

Static

static

10

Xeno-v1.3.60/Xeno.exe

windows10-2004-x64

10

Xeno-v1.3.60/Xeno.exe

windows11-ltsc_2024-x64

10

Xeno-v1.3....UI.exe

windows10-2004-x64

1

Xeno-v1.3....UI.exe

windows11-ltsc_2024-x64

1

Xeno-v1.3....x.html

windows10-2004-x64

6

Xeno-v1.3....x.html

windows11-ltsc_2024-x64

6

Xeno-v1.3....ain.js

windows10-2004-x64

3

Xeno-v1.3....ain.js

windows11-ltsc_2024-x64

8

Xeno-v1.3....ain.js

windows10-2004-x64

3

Xeno-v1.3....ain.js

windows11-ltsc_2024-x64

3

Xeno-v1.3....nls.js

windows10-2004-x64

3

Xeno-v1.3....nls.js

windows11-ltsc_2024-x64

8

Xeno-v1.3....-cn.js

windows10-2004-x64

3

Xeno-v1.3....-cn.js

windows11-ltsc_2024-x64

3

Xeno-v1.3....-tw.js

windows10-2004-x64

3

Xeno-v1.3....-tw.js

windows11-ltsc_2024-x64

8

Xeno-v1.3....der.js

windows10-2004-x64

3

Xeno-v1.3....der.js

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    Xeno-v1.3.60.zip
  • Size 6.9MB
  • Sample260820-gsa3vsfl2w
  • SHA256 8ecb968055c59dee679ef20ceff9a09eaa9ca10f23717c10fbe39d7d8a7b0a2b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
sheetratadwarediscoveryexecutionpersistenceprivilege_escalationransomwarespywaretrojan

Malware Config

Extracted

Family

  • sheetrat

Version

  • 1.8

C2

  • neimdmhk.torgports.shop:22565

Mutex

Attributes
  • anti_virtual

    false

  • certificate

    fejnezt6j95d4z1cec

  • exclusion_wd

    true

  • hidden_file

    true

  • install

    true

  • install_watch_dog

    true

  • key

    azar24ows

  • path_client

    %Windows%\exploler

  • path_watch_dog

    %ProgramFiles%\exploler

  • pump

    false

  • rootkit

    c9urnkfci9p197lqqjuz0k

  • task_client

    ShellHost

  • use_install_admin

    true

  • user_init

    false

Targets

    • Target
      Xeno-v1.3.60/Xeno.exe
    • Size 188KB
    • SHA256 2c0b246871f4863163b65cb3eab0afadc9d427afebecedb0bd11b03e95dbb615
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryexecutionsheetratpersistenceprivilege_escalationtrojan

    • Detects Sheetrat Payload

      Sheetrat aka NonEuclid RAT is a trojan written in C#.

    • Family: Sheetrat, NonEuclid rat

      Sheetrat aka NonEuclid RAT is a trojan written in C#.

      trojansheetrat

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery
    behavioral1behavioral2
    • Target
      Xeno-v1.3.60/XenoUI.dll
    • Size 145KB
    • SHA256 6e5ddbf5d1a9f963cf0bc9bd459dcff983e95704abd5cb1c582365f3eadb2ebc
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      Xeno-v1.3.60/editor/index.html
    • Size 164KB
    • SHA256 43e332faef4019a95d3b72205da7ce72bc4ccd25f53399352b68442f0b55dad2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discovery

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    behavioral5behavioral6
    • Target
      Xeno-v1.3.60/editor/vs/base/worker/workerMain.js
    • Size 133KB
    • SHA256 e90d1a8f116fa74431117a3ad78dde16dde060a4bf7528dfe3d5a3ad6156504b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    executionadwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral7behavioral8
    • Target
      Xeno-v1.3.60/editor/vs/editor/editor.main.js
    • Size 2.1MB
    • SHA256 b604b6148f70fe9db882cce2a7d327b2422ad2f203a805491002a8c564e3c3ff
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral10behavioral9
    • Target
      Xeno-v1.3.60/editor/vs/editor/editor.main.nls.js
    • Size 38KB
    • SHA256 5ff0084e6a7eee82a735616239aaf2190ea9d90e89e19340831f3d590828016a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    executionadwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral11behavioral12
    • Target
      Xeno-v1.3.60/editor/vs/editor/editor.main.nls.zh-cn.js
    • Size 36KB
    • SHA256 e9adc8ffca9853ef6e0bd4e955af9f395a570bc7772fc2dac0c0ff241aac864b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral13behavioral14
    • Target
      Xeno-v1.3.60/editor/vs/editor/editor.main.nls.zh-tw.js
    • Size 36KB
    • SHA256 94a7ff81b8ec3217a46bc5cdebe2c6aee98f73e6e902b7d9cf394836d052bbe5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    executionadwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral15behavioral16
    • Target
      Xeno-v1.3.60/editor/vs/loader.js
    • Size 29KB
    • SHA256 5c3cf09973404ba31d760952f267751ef2bb09f315331d13ca432b65ce2c480b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    executionadwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral17behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

JavaScript

1
T1059.007

Windows Command Shell

1
T1059.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Event Triggered Execution

1
T1546

AppInit DLLs

1
T1546.010

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Event Triggered Execution

1
T1546

AppInit DLLs

1
T1546.010

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

2
T1120

Query Registry

5
T1012

System Information Discovery

5
T1082

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

static1

trojansheetrat
Score
10/10

behavioral1

discoveryexecutionsheetratpersistenceprivilege_escalationtrojan
Score
10/10

behavioral2

discoveryexecutionsheetratpersistenceprivilege_escalationtrojan
Score
10/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

discovery
Score
6/10

behavioral6

discovery
Score
6/10

behavioral7

execution
Score
3/10

behavioral8

adwareexecutionpersistenceransomwarespyware
Score
8/10

behavioral9

execution
Score
3/10

behavioral10

execution
Score
3/10

behavioral11

execution
Score
3/10

behavioral12

adwareexecutionpersistenceransomwarespyware
Score
8/10

behavioral13

execution
Score
3/10

behavioral14

execution
Score
3/10

behavioral15

execution
Score
3/10

behavioral16

adwareexecutionpersistenceransomwarespyware
Score
8/10

behavioral17

execution
Score
3/10

behavioral18

adwareexecutionpersistenceransomwarespyware
Score
8/10