200efe2404a9ec927e6abc373f75ba19fbd1a4dfddb95f1ae2c2da4954362516

Sharing

Copy URL Twitter E-mail

General

Target
Xeno-v1.3.65.zip
Size 2.2MB
Sample261113-ngb94sty5m
SHA256 200efe2404a9ec927e6abc373f75ba19fbd1a4dfddb95f1ae2c2da4954362516
MD5 8c8825b35a977b8d8c7f2bdafcffc7b5
SHA1 3f527512a653186b4c11d3c294bbdf8dd0de71c1
SHA512 ef8d0c6eb73360028683a0b5028ddda2ad855cdd92da208b23b7740a5b808b5c9ef4275c5c03b08ce0d6850c41a534f6ad722445fccaf9c3214a4ce0856e59f9
SSDEEP 49152:xIMBiN0hVZBFabRJYBzUFeb3auxFpfjUPf9oY4g:Vw6hVLFAYhUFeLauxFp4doYh
TLSH
T13CB53370DE3817B29C0AFB1794BA0E6DB83A14F24D4B39E29C5537B0A2299C3D5079E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Targets

- Target
  Xeno-v1.3.65.zip
- Size 2.2MB
- SHA256 200efe2404a9ec927e6abc373f75ba19fbd1a4dfddb95f1ae2c2da4954362516
- MD5 8c8825b35a977b8d8c7f2bdafcffc7b5
- SHA1 3f527512a653186b4c11d3c294bbdf8dd0de71c1
- SHA512 ef8d0c6eb73360028683a0b5028ddda2ad855cdd92da208b23b7740a5b808b5c9ef4275c5c03b08ce0d6850c41a534f6ad722445fccaf9c3214a4ce0856e59f9
- SSDEEP 49152:xIMBiN0hVZBFabRJYBzUFeb3auxFpfjUPf9oY4g:Vw6hVLFAYhUFeLauxFp4doYh
- TLSH
  T13CB53370DE3817B29C0AFB1794BA0E6DB83A14F24D4B39E29C5537B0A2299C3D5079E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
behavioral1 behavioral2
- Target
  Xeno-v1.3.65\Xeno.dll
- Size 2.3MB
- SHA256 64cf85638d35d5fa741dc67866a31fa8a2f9606e501b22dc266214041a52b07a
- MD5 64f86791ddd2e64ea2c6878517c26c5a
- SHA1 0f7c8b2c7ef75bff80a8ebea251533054a85d1f2
- SHA512 934da22fecd205917b827c2aeb742093744a3d47d225b04c9d91d7eb835bd03cd82ab5e012c24d252df23cff8758cbec5f6d348ac628799b990c328282cad7ce
- SSDEEP 49152:Ho/h73ywvIn2CFolrUJXvxNZONxncaAeaO3sENKbv01S:QeMwvxNUl0tPEu0o
- TLSH
  T153B59E26F59901FCC076D1F8CB6BA623E7727849033056EB06E0DA653E17BE55B3AB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Xeno-v1.3.65\Xeno.exe
- Size 2.8MB
- SHA256 a81bca81013a281868467e34e01f947907e5838772282c585fb19dd2298e1fd6
- MD5 e5fe46a2d9430647fd3183e7b44ebc9d
- SHA1 bce5283fbed78ce033f23727d7d705b811c07edc
- SHA512 ae9768fb2eb233b0aaea42f1923ec8ef81e840ad72ad716f2309ad0538082a0e9811e1ee0afb9517df19e384c8249c9aea179934502efb2cddc39cdb6b1ff46c
- SSDEEP 12288:EAe/cH7+Osa2T2+2ayjw9/zeSC8I4BVg586qI4P/VPnXI5RgfpbGZLAUN9Zk23Sr:LmcHCOC
- TLSH
  T1DFD52313B24198F8F48BC078935BC163AB767C850B2574EF06E47A783E7A8D5AB39705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral5 behavioral6
- Target
  Xeno-v1.3.65\XenoUI.dll
- Size 145KB
- SHA256 37524c816a6b7fcd79dd76dc78020de3497073220fa041f4ad7aab7d6bcd53f4
- MD5 308c6b055255212a8c6193d3f2962d3f
- SHA1 5969258b7efcb0ff10ea3a5886f1afffee9c0045
- SHA512 7bddf4308e5fbebfd889e5c15184c49319f65ca1314c4252c7d559027ed06dd43fe0a9c094ed4bba5a1dc4b3ac958a5c8536a6a56711064fbcb360bf0d0bfafb
- SSDEEP 3072:ZBMd4YOG6EEaScUrlP2TbyGS6CMz7Pby6SgV9Sj0LC55dVPOdX09MheI:44trp2HyGjfby6p9Sj0Uh2dk+eI
- TLSH
  T149E3B041376C8A22CABF0FBD54B652955A71BF16A563E70E14CC349C2CF738286523AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8