4d53875a7fc6f65842488484d95eae9df10a7ace1e4cebdd6f4959770500f5d0

Sharing

Copy URL Twitter E-mail

General

Target
Xeno-v1.3.60.exe
Size 84.8MB
Sample260821-cl26js1bpd
SHA256 4d53875a7fc6f65842488484d95eae9df10a7ace1e4cebdd6f4959770500f5d0
MD5 b857711f0516ecbd54da4f4c15980d07
SHA1 d049c39512cca37ad4a0ba798527973cae2f18dd
SHA512 1cea7234e297dbe20168122d531fcb5bd08ddc8892c4739e5ea7423239268a97b931ee5199fcecc25fe9be67dab73d411216a65122d9d2cae9ac75f6d01636d8
SSDEEP 1572864:3z7mGUFQi28oCKlR+lk9suop3T99fwXGVuRiXzO/eGbNQZoJs:3z/UurlR99poNPIXGIRMO//bNrs
TLSH
T1B3183390ACCD31AECCACD5F4D860B2052079DE0F99546A23203E7BAF3DB74664DD6963
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Targets

- Target
  Xeno-v1.3.60.exe
- Size 84.8MB
- SHA256 4d53875a7fc6f65842488484d95eae9df10a7ace1e4cebdd6f4959770500f5d0
- MD5 b857711f0516ecbd54da4f4c15980d07
- SHA1 d049c39512cca37ad4a0ba798527973cae2f18dd
- SHA512 1cea7234e297dbe20168122d531fcb5bd08ddc8892c4739e5ea7423239268a97b931ee5199fcecc25fe9be67dab73d411216a65122d9d2cae9ac75f6d01636d8
- SSDEEP 1572864:3z7mGUFQi28oCKlR+lk9suop3T99fwXGVuRiXzO/eGbNQZoJs:3z/UurlR99poNPIXGIRMO//bNrs
- TLSH
  T1B3183390ACCD31AECCACD5F4D860B2052079DE0F99546A23203E7BAF3DB74664DD6963
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LICENSES.chromium.html
- Size 7.9MB
- SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
- MD5 0e3e4362f785aff0b9e1852b1064c0f1
- SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
- SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
- SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
- TLSH
  T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Xeno-v1.3.60.exe
- Size 156.0MB
- SHA256 a83f3476e11bbbc9f7962cec2357e6e35fcdae691c8dd4ec19718e6d13873d92
- MD5 133f6b3a3c0c5110fc33e9152e43690b
- SHA1 14db35769ec3ac4c2d5596ab076ad04700901f3c
- SHA512 1cb38ab62a30beca73c11ed916b10747cd2b19b00f9bd9507b4125ed6f4776dda82478c4c7f90e681c05cc75d21160ebe5cd29ceb773fc37de44ae94053f0564
- SSDEEP 1572864:LVU4t/Ct6JMgabao+nh+bw4FlWMZBZHuoM2t52kOUeEbaVO7GJbdHDexdypGT+LY:lYUJkH0sEQ
- TLSH
  T1C6788B03E29A00E9E05DD1B587578237EE72B8864738A6DF2754175A2F77FE02B39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral10 behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- MD5 2191e768cc2e19009dad20dc999135a3
- SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
- TLSH
  T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  ffmpeg.dll
- Size 2.7MB
- SHA256 e1ab367644f72ebcdc8eb3fcfe829ff51719559ac2a43a1600e712b16871ad65
- MD5 d5e1f1e9d0ccfe7f21b5c3750b202b4d
- SHA1 74144ac93c0c58a9b9288bce5d06814c9a1b1dc2
- SHA512 dcf70d43f1a83c424be99c38e33e520c72115c3d30945980e5e394d460462251bde309e543213b2b08dcbe9769d11d46792e1cc99aa42777fcc34d6f3361a3d2
- SSDEEP 49152:EZ2KxYmwFfgQQs0ShPrF0/zO6R0gRhPj3hTUctrRhuwSnKxqgI5IN8N3lzl3hqzb:Aofp1Pyi54wnKxqg4INhhd
- TLSH
  T10DD5AE07F6D640D9D029C174869FA233F63134468B24A7EF1A909A252F7BFD46E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  libEGL.dll
- Size 469KB
- SHA256 e142752e073c0051a0beb963981af70263ed673959515545521a7941d3230838
- MD5 dd78b86b3c92d61c37b44ef5b157cfe0
- SHA1 4dcf9ebc3ff5ca552c0e83469b921153b29aea1f
- SHA512 9d071568dc56db2ab93d034d07a11a477aab8ac50d9ea3c4db3ac4866fcd3c2f3002ba7a3f2c55589a9d68463181fc7a03327dc164310d7e80e30cc6f6bf2423
- SSDEEP 6144:s4itlpEJVqKqK5Z5UibKsBHI0Sfnx+lXGpeOQHA93GT3sm:s4itlpAqKqK5Z5U+jBolfnjIyG
- TLSH
  T120A48D15779544A9D06AC434CA534612EE76B8920F35FADF02A4E23D2F7BBF85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  libGLESv2.dll
- Size 7.1MB
- SHA256 b0ff1bad8e2f34b12dfcc4b5387bdc042f9bc2f963e11dea1758397ca0e907ea
- MD5 af3792b63af63408a40604184ea6ef7f
- SHA1 b4d577e1c7ca0d4d3a34e2edb919cf58e6b62952
- SHA512 d413c52f7c82dd17f06002f3ca6bc3efcf4e11e88379d989d982b2f9f47b71643971c4988abee2dc1212027b2cea148a8849bcb442dd4dbcd8e26ea892dd7a58
- SSDEEP 49152:x2b3imtb1uWsvZRUCXQNMBbGUa/XFfOpvQnDwX+xjA7LAIgRg37QiI+id3pFJs7w:x7RWft4NV+sduHox6gWE5lHaFX
- TLSH
  T168767C07F2A541D9E05DD2B9CB4B9232FA30B899473072DF6A9817213F67BE06B79710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  resources/app.asar.unpacked/native/xeno-addon/build/Release/xeno.node
- Size 152KB
- SHA256 b29fe50685d3e61eef0123123c64276d5ee7816de0e695d132e6884314c78f9e
- MD5 4b2c873f81f12b04966451a4cb52b6dc
- SHA1 174df7d5b2fe482970ce1b48840947faad637bf9
- SHA512 b73ef1fe628cda3e3a6c01ed7bbb4bce360bd8c168e9c9ffcbb8605e352cd0901926fdab04b72834d6e9a6b0a6383a7c2bdb5abcedfac19ea33a6122ab7f3932
- SSDEEP 3072:e/oBISptd/e6Iayfev5XcIaOlpcg8S4vP:e/6JDdG6IEXog0P
- TLSH
  T121E34C17A6A9507BD267C535C8834A01EB72BC564790AADF47500FBA1E237E0DF3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20 behavioral21
- Target
  resources/public/Xeno.dll
- Size 2.3MB
- SHA256 c015896a88b7dd391c1fcfb612d18ec2585ed74162d197f09c2f22bc9aa5545d
- MD5 0605723ab6eb4c0fe718c0cc33e31424
- SHA1 fba34d0a82515c91e5f36413330c3296407e6138
- SHA512 a76266f8f844f94f3dea766c84fa17b2398de5d54f9cdfd896e8b2315b279971173c42833fae957b674e4ea41e997ea5f9b454f7cc978b6ba5e970c23b556290
- SSDEEP 49152:5+jqPOu2DM1P8daBpcU5TgySscBxFkUXDBIhm1/:Je8/WbTFhDDd
- TLSH
  T1E5B58E67A59900ECD076D1F8CA1B5513E7B27C4903306AEB02E0B9652F27AF58F3EB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  resources/public/api-ms-win-crt-convert-l1-1-0.dll
- Size 15KB
- SHA256 94b6e91b93c2202dabd659bff294bee87c22897a30a6b4930b49051c2fb502dc
- MD5 c8dbf0ca88facfe87899168a7f7db52c
- SHA1 e2cf163ad067b5d3b19908a71ed393711f66cd09
- SHA512 e85c738f5d5a0ae6c3ef75a082712cb3cf2feae4560d316cb110e4eaf3a97d6058d5374da2a5edde39c3114f9aff8a027cbdff8cf49be2425943bac09c39e70b
- SSDEEP 192:w89M0wd8dc9cy1WphWWD1S8f4DBQABJt9o0Z5uE7Mqnajcno:wt0wd8xy1WphWWD1IDBRJtO0zuOMlAo
- TLSH
  T1A762A49366E43F15EA9F277221FEDBD72A391B81255043B8C607E54C3882782BD97C0E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  resources/public/api-ms-win-crt-environment-l1-1-0.dll
- Size 18KB
- SHA256 f7c6c7ea22edd2f8bd07aa5b33cbce862ef1dcdc2226eb130e0018e02ff91dc1
- MD5 c712515d052a385991d30b9c6afc767f
- SHA1 9a4818897251cacb7fe1c6fe1be3e854985186ad
- SHA512 b7d1e22a169c3869aa7c7c749925a031e8bdd94c2531c6ffe9dae3b3cd9a2ee1409ca26824c4e720be859de3d4b2af637dd60308c023b4774d47afe13284dcd2
- SSDEEP 192:sfW1hWiQcvHCjdks/nGfe4pBjSY6Na3sAW5RKTt3E2sVWQ4GWIjcyqnaj/6g6dqd:sfW1hWPQim0GftpBjzim3StltFpn
- TLSH
  T1F2822BC69ABC9543F9C3AE7052B8EA877D3DDBC31D20812605A9F5982CC73D1EB1092D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  resources/public/api-ms-win-crt-filesystem-l1-1-0.dll
- Size 13KB
- SHA256 51541ec6684b43157a85ea46a42ebed4555be06bed0d0d07ff3ea6377301318d
- MD5 42a2a95f1bb940d01f55eb1674a81fe2
- SHA1 f982f3bbb4dc3aaaba8df098d1b395846f7cba08
- SHA512 de9a7a1a6a45e2f76105eaeafcc3c29adbff142dcf2586e147417045b897a9dcddec5e1b97acfc5d3fc9c8e3a508dbc3f607bf3df20a7435e74436f94cb056b6
- SSDEEP 192:zt/PGnWlC0i5C9WphWAeD1S8f4DBQABJJ2yy2D8KN3qnajV2MVorr:VunWm5C9WphWbD1IDBRJJkt2lxnorr
- TLSH
  T18852F78347E47E02EAA72B3112FDDBDB3F3D5781185247668006A52839E73C1BF1659D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  resources/public/api-ms-win-crt-heap-l1-1-0.dll
- Size 12KB
- SHA256 80139e4caa379d87b1d1dafc23ace71d2b330368115f6314140d4ae59c2a78e8
- MD5 98da186fd7d7873c164a51c5d7b77f1a
- SHA1 725a8b8fdfbe6a1e85674f4b2a7c0dd08411e00b
- SHA512 587b49a24cc59d4dcb62b59f379d1c9010196a6551cfc99ffdd931eeb0172618f020863191e530d65ad198e57063c57ba6f70bcf80591304243268ea5513f806
- SSDEEP 192:DaY17aFBRQWphWp+QD1S8f4DBQABJtAa46ArNc4qnajr7PQW:7VWphWFD1IDBRJtAa54lrPQW
- TLSH
  T1BB421CC387B85903E7637F7026A9D68B3D3E67C66D6085668057F2A52C833C5EF0162E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  resources/public/api-ms-win-crt-locale-l1-1-0.dll
- Size 11KB
- SHA256 7bb8644e565ad4bcfd890f9044bccb4d99953a740e9a500b1f820b2fdc3fc240
- MD5 ff48b107b2449a647c64baabd49408a1
- SHA1 efb868ba125d9ff08474f02b9483d74c36a13cee
- SHA512 4da2e4b727e7f31f8bffd680453c451b444bdf217c15cb36e353f8bb5ecb6c6481caa7d848558c7d94cfc2d1bc3551ace11e85ffc8ec7a7b570a59c294ea0216
- SSDEEP 192:JWphWzDD1S8f4DBQABJtySO5M8xOSqnaj3yAY9:JWphWHD1IDBRJtyICTluAY9
- TLSH
  T141422B868BB82803E6927F7006A9D6877D3E63C31811856A5087F6983C433DDEF01B6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  resources/public/api-ms-win-crt-math-l1-1-0.dll
- Size 20KB
- SHA256 8a7bff1c918539a75c25568db25933d653c003e016fd7791a37186b42bbb7c20
- MD5 e10e077bb06209aedd0d0d378c758f73
- SHA1 97a9053a311280678f8ef65dc4e25975c41bd4ee
- SHA512 571c1fc4192320bd967b603e6cda917a62f4720eb4dcd557ec2913d2558c0cfe68f936198f5809934aaa3a1d6049e8e918eb0e638a7244df5c71ef0c78843191
- SSDEEP 384:rJI2M4Oe59Ckb1hgmLZWphW1D1IDBRJJo95DKlxT1xpN:ri2Mq59Bb1jEkI1PU5Dmv
- TLSH
  T1F592B68749DCFF67D28F17B701F08BCE6A381AA254E1B6B4C81B918934927C47E4394D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  resources/public/api-ms-win-crt-runtime-l1-1-0.dll
- Size 16KB
- SHA256 07382c0d91dad2bb6ba8bd06ea02f12c57abf7c4e5a70672e9f2954d09a4ffd4
- MD5 f91e1ff896b5616919ac97c7095c513e
- SHA1 4ec6eed0bac5a8801db10238c7b3a5d35a87be67
- SHA512 6448d6cdfde11e1805b6d381111ea062f681807c9dc54ae890305f287b13b6fb57ef3f4d3b909e56b81c99830c086b5702b46ba0f93e695fce2b87b32fa4b26a
- SSDEEP 192:uaajPrpJhhf4AN5/KipWphWAzD1S8f4DBQABJJLQ67T0q11qnajVtPx5g:ulbr7fWphWiD1IDBRJJL7Tplxb5g
- TLSH
  T1F272E7834AE87F27E68B3B7316F9D7D72A36638629104179C857E1D938C3781BD0721A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  resources/public/api-ms-win-crt-stdio-l1-1-0.dll
- Size 17KB
- SHA256 2a466648affd3d51b944f563bb65046a3da91006a0d90fb2c0b123487a1fc1b3
- MD5 429c26ed27a026442f89c95ff16ce8c2
- SHA1 69ed09faae00a980c296546c9b5e6a8d5f978439
- SHA512 04641164d9e1eb3183db0c406583626011dfe2b2574551c0ac466ebf44165afcd7d8faf356b8268b4fc9a54db20de010a4e4293594ad2e605950aea65636f4e5
- SSDEEP 192:BpPLNPjFuWYFxEpah7WphWRD1S8f4DBQABJ+SiLuEbNEdiqnajVCpEbOg4:B19OFVh7WphWRD1IDBRJ5iLbnlxkEf
- TLSH
  T16082C58385EC3F46D28797331AFAEBEB5635538328147278C407E9943ACA389BE0755D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  resources/public/api-ms-win-crt-string-l1-1-0.dll
- Size 18KB
- SHA256 bf4ea10be1b64c442ac0ccf4bdf69f6703467176a27e9e14a488d26448a6e179
- MD5 0f593e50be4715aa8e1f6eb39434edd5
- SHA1 1117709f577278717c34365ce879bcd7c956069b
- SHA512 487dcbf7b7f18d62606cb2f05c8feff07e6ecda42e643f5919c6edda66cdb3b8cc393b0d260374f06c10cf54082410fc9f02bd87cc50866bc0c28b0bcec3e658
- SSDEEP 384:fFvU4x0C5yguNvZ5VQgx3SbwA7yMVIkFGl3WphW+D1IDBRJ5YBMOnlxkEx:p5yguNvZ5VQgx3SbwA71IkFxVI1PKJ
- TLSH
  T11982B58346F83F45CA8F57B319FAC7C72A384B4625411375C467A58C3882B96BE6BA0D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Checks computer location settings

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32