42755d7735ab3eabc7fac074eb5e631212f4df02c6de60ec8de4af4b1b39f913

General

Target
Xeno-v1.3.60.zip
Size 6.8MB
Sample260825-pg14xaha86
SHA256 42755d7735ab3eabc7fac074eb5e631212f4df02c6de60ec8de4af4b1b39f913
MD5 fbe8154d51b06173ecb2f2d009d58eb3
SHA1 44fdc7f32ea4474c7142d1d541a8ee472fa68ef5
SHA512 d37415fcae697972c49400841297ec4f9826b5d37faadf5b6daaae586a0a7996ef4e47f0a9f3152165de1032156b6fc15551681778d99022d54f6925066e5ae5
SSDEEP 196608:ApFx0v3bGBvG7bM0Y2XaCzC/s+528kgAjJdcABwP:ApFKv3b/nMkhZ8kgAKP
TLSH
T17576338CAAFC05E3FB3441B869615EF4B257B3846A42A507D988049761AEDD04FC3B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Xeno-v1.3.60/Xeno.dll
- Size 2.3MB
- SHA256 9d16d62878486d6caad6536c702de88165d2b07aaf124dd090559fbc424b3a3d
- MD5 9fcd0650519b5e5265fe5f07eb894c31
- SHA1 f531ff4b7eccd8a3caf31dc7ce35694de76e8cbf
- SHA512 fb2dad25e02f074c12bc49262aea08c4c2baf0ffc4280366eab2f890881526b134716bbf7174505730c6cfd40b2d9b050a5694a0d0cb670b857a201be8bc2b49
- SSDEEP 49152:h+jqPOu2DM1P8daBpcU5TgySscBxFkUXDBIKm1X:he8/WbTFhDe9
- TLSH
  T1C4B58E67A59900ECD076D1F88A1B5513E7B27C4903306AEB02E0B9652F27BF58F3EB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Xeno-v1.3.60/Xeno.exe
- Size 164KB
- SHA256 ae6fc5ba07dc314423a518f93b8ad69a5730df780669fd3b40283c32b24a56fc
- MD5 6156707c90644ea4edb71f3044d1c8d9
- SHA1 237a4262696840719021a53e9322ca1fd0d6fb0d
- SHA512 8fc14005a4ec1cc372e7be1d64c12899a9f304f6002ef1c87bf510697c3ee9fb8753a042e6d2ef5dde6805f349b96847f09a19ab0fa5385ea7e7ee915054d13d
- SSDEEP 3072:520jWfVKLer59aSpfO9D/87jXEkeFZA4nsSyU3i4w:MIhSpfO9jC/44Uhw
- TLSH
  T189F34B07A6A840BEE1B7D679C9924941FB723C558B71A6CF03507AB60F777D0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  Xeno-v1.3.60/libcrypto-3-x64.dll
- Size 7.1MB
- SHA256 16e85806333aa3b3a4fe8c31c9402b78ee01a4a143e9031db165c48386dd6289
- MD5 b47c9988a203a596803837c128853517
- SHA1 2f669bf535dde5727989da919ffa5c36cf9d78e2
- SHA512 24874b5902785cea67d3781e59471e6b8fb8c9d9e6e33e8c894745eb4324bfa1ab123ff2809269e1a7b2eb604343efe556183479c0e0d30214dec252c31fb69b
- SSDEEP 196608:uHhm399Xki0GiR/8yGX26ui1CPwDvt3uFOxC:uHhm399XkifiR/8rGfi1CPwDvt3uFoC
- TLSH
  T164767BADA67C0109E8AA81BDC2979327D771B91957F013CF186196F80F23FD92B7A740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3