Extracted

• • Target
    Xeno-v1.3.65-09.exe
  • Size 87.9MB
  • SHA256 507da12e8e27d0531d9481fb67df473fc7b843c686d23163e2ecb3f00ed412d9
  • MD5 66308ba34721006cdda045e3efa046f4
  • SHA1 dafbce24dc7e49c42de608cb5f189554edeaade8
  • SHA512 9b2b0b43389d8dbed64ebb22d608dd56f70aaf044d1dc27926501d2596f0a81498b3d9d4e530419e10c632b499ed6ac65549c89bafa0d4e21b97a6c3c78f0b85
  • SSDEEP 1572864:yhCN/zd1t1zDfnXyrOL8roVY8cys+akqXlkF/tcC6G6GRhjN59nboQtQYAQyGvf2:OM/z/t1zuOmKGy+kq2F/CC6G6ChvnkKe
  • TLSH
    T1B118331B93ED01ACC0A3C17E8E475507EAB13C462771AADB16B0B5565FB7BE01E3A231
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1