#xenorat_020924

#IOC #OptiData #VR #xenorat #stego #pngbase64 #PowerShell #RegAsm

https://pastebin.com/g3uLCCqB

previous_contact:
n/a

FAQ:
https://github.com/moom825/xeno-rat
https://malpedia.caad.fkie.fraunhofer.de/details/win.xenorat

attack_vector
--------------
email attach .rar > .rar (pwd) > .vbs  > WScript > powershell > get bitbucket .jpg & .txt > RegAsm.exe > C2


# # # # # # # #
email_headers
# # # # # # # #
Date: Mon, 2 Sep 2024 10:51:51 +0200
From: Господарський суд Одеської області <contact @diagjfl _fr>
Subject: Повідомлення про виробництво щодо ТОВ _назва_жертви
Reply-To: Господарський суд Одеської області <inbox @od _arbitr _gov _ua>
Received: from ns0 _arobiz _pro ([185 _34 _32 _71]
Received: from (unknown [217 _196 _98 _177])
Message-ID: <20240902085152 _BA7402E00CF1 @mail _arobiz _pro>

# # # # # # # #
files
# # # # # # # #
SHA-256		   93b777a3bf5c868c9fec5465aa912f79e45589d136cb7e32e74c995ac80c8631
File name	   Документи (СУД).rar
File size	   11.67 KB (11955 bytes)

SHA-256		   17504af5f0b685f934404a49fe6ce392cdaa9717b70099635383d450708d3f89
File name	   Документи (СУД).rar
File size	   11.20 KB (11470 bytes)

SHA-256		   5640cb7c1399cf63031ade147e623ad9f9d63fb350addc550eae4141c2fe4431
File name	   Копія вихідної позовної ухвали.vbs
File size	   14.40 KB (14741 bytes)

SHA-256		   3e243672f6c94dd0edc7e41d6ab0920b1cd174fe102c71ae73d013c552edd6e4
File name	   new_image(1).jpg
File size	   4.71 MB (4942734 bytes)

SHA-256		   f20c466371b9a1447ffd85284b95d8ec4959373f824bf0363b82eaa4ac18b4cf
File name	   5652.txt
File size	   61.36 KB (62836 bytes)

# # # # # # # #
activity
# # # # # # # #

PL_SCR          bitbucket _org /hgdfhdfgd/test /downloads/ new_image.jpg? 11811735   [loader]
                bitbucket _org /hgdfhdfgd/test /downloads/ new_image.jpg? 14441723   [loader]
                bitbucket _org /sdgw/sdge /downloads/  .txt                       [payload]

C2              111 _90 _147 _147


netwrk
--------------
185 _166 _143 _49		bitbucket _org	443	TLSv1.2	Client Hello (SNI=bitbucket _org)
52 _216 _217 _105		bbuseruploads _s3 _amazonaws _com	443	TLSv1.2	Client Hello
111 _90 _147 _147		5652	TCP	50725 → 5652 [SYN]

comp
--------------
powershell.exe		185 _166 _143 _49
powershell.exe		52 _216 _217 _105
RegAsm.exe			111 _90 _147 _147

proc
--------------
"C:\Windows\System32\WScript.exe" "C:\Users\User01\Desktop\Копія вихідної позовної ухвали.vbs"
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = . . .
        startFlag = <<BASE64_START>>; endFlag = <<BASE64_END>>
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

persist
--------------
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run				Mon Sep  2 16:41:22 2024
My Program	Windows PowerShell	(Verified) Microsoft Windows	C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe	Mon Dec  4 08:21:56 2023
powershell.exe Invoke-Expression 'C:\Users\User01\AppData\Local\Temp\svhost.vbs'

drop
--------------
C:\Users\User01\AppData\Local\Temp\svhost.vbs

# # # # # # # #
additional info
# # # # # # # #
mutex       fjsjhgf

# # # # # # # #
VT & Intezer
# # # # # # # #
https://www.virustotal.com/gui/file/93b777a3bf5c868c9fec5465aa912f79e45589d136cb7e32e74c995ac80c8631/details
https://www.virustotal.com/gui/file/17504af5f0b685f934404a49fe6ce392cdaa9717b70099635383d450708d3f89/details
https://www.virustotal.com/gui/file/5640cb7c1399cf63031ade147e623ad9f9d63fb350addc550eae4141c2fe4431/details
https://www.virustotal.com/gui/file/3e243672f6c94dd0edc7e41d6ab0920b1cd174fe102c71ae73d013c552edd6e4/details
https://www.virustotal.com/gui/file/f20c466371b9a1447ffd85284b95d8ec4959373f824bf0363b82eaa4ac18b4cf/details

VR