Xeno.exe Stealer Gen Analysis

Stealer Gen

Updated on 2024-11-04 (16 days ago)

Online Virus Checker	v.1.0.195.174
DB Version:	2024-11-04 17:00:26

Spy.Win64.Gen.tr

This is a generic detection name used to identify a potentially harmful or suspicious file or program that exhibits characteristics of a Trojan horse. It is malware that disguises itself as a legitimate or benign program but contains malicious code or functions.

File	Xeno.exe
Checked	2024-11-04 15:13:21
MD5	2461a0cd4586b779c4a8fb8328ba2eca
SHA1	b71366fe441c6164ac619805e99293570184f3e8
SHA256	8e0e663a5a969a773da89d0e344f7ee472c84ba0149a3af052ed8f6a0a0158a2
SHA512	77a7ff3c41c82ffef03721f1247486f2cbc4ede072528df60c46efd231e58e4bbc3e74e228233dd965f2147b5539cdb6df08112bba683025d7845a487190dbf7
Imphash	6a91eb82bfd19d2706c7d43c46f7064e
File Size	143360 bytes

Spy.Win64.Gen.tr Removal

Gridinsoft has the capability to identify and eliminate Spy.Win64.Gen.tr without requiring further user intervention.

Start by downloading Gridinsoft Anti-Malware to your computer.
Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
Click on the "Standard Scan" button.
After the scanning process is finished, click on "Clean Now" to remove any detected threats.
If prompted, restart your system to complete the removal process.

File Version Information

Translation	0x0000 0x04b0
Comments	Xeno - Executor UI https://github.com/Riz-ve/Xeno
CompanyName	XenoUI
FileDescription	XenoUI
FileVersion	1.0.85
InternalName	XenoUI.dll
LegalCopyright	Rizve
OriginalFilename	XenoUI.dll
ProductName	Xeno
ProductVersion	1.0.85+87ae4f96f8a0927052c1120167982fb069afd1b4
Assembly Version	1.0.85.0

Portable Executable Info

	a555f57d346157adb832b257d0c44628 e95a9a012cca762fa325e0a4b05fb51d 00e0c0d10c00a002
Image Base:	0x140000000
Entry Point:	0x140011240
Compilation:	2024-07-16 05:07:12
Checksum:	0x00000000 (Actual: 0x00023c26)
OS Version:	6.0
PDB Path:	D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
PEiD:	PE32+ executable (GUI) x86-64, for MS Windows
Sign:	No valid SignedData structure was found.
Sections:	6
Imports:	KERNEL32, USER32, SHELL32, ADVAPI32, api-ms-win-crt-runtime-l1-1-0, api-ms-win-crt-stdio-l1-1-0, api-ms-win-crt-heap-l1-1-0, api-ms-win-crt-string-l1-1-0, api-ms-win-crt-convert-l1-1-0, api-ms-win-crt-time-l1-1-0, api-ms-win-crt-locale-l1-1-0, api-ms-win-crt-math-l1-1-0,
Exports:	0
Resources:	4

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Entropy
.text	0x00001000	0x0001596c	0x00015a00	b7829d1c3d7c312ecad59d1d841abd20	6.34
.rdata	0x00017000	0x00009686	0x00009800	beea0244621e65f69b80fd9a84404045	4.45
.data	0x00021000	0x000018a8	0x00000a00	1c6153db8e5ea54f9a448dd9689e2058	2.37
.pdata	0x00023000	0x0000135c	0x00001400	f23fbca2e04df64b228a11117af9423e	4.88
.reloc	0x00025000	0x00000328	0x00000400	55e90cab3136fc60d495ca1b5b9b4abb	4.76
.rsrc	0x00026000	0x0000175c	0x00001800	e1f500948bc4d6356ea1052e0745523b	2.88