xenorat | a13f6a97d4f58a2524b770606f1264578bc94f287105378f5c3fe0f06d21053f | Triage

Sharing

General

Target

dw.exe
Size

45KB
Sample

240324-cnvjgsgd96
MD5

c3ca905c411c1141d577bf5b10edafb4
SHA1

0156ed929401995e25c587f85851d44020938406
SHA256

a13f6a97d4f58a2524b770606f1264578bc94f287105378f5c3fe0f06d21053f
SHA512

6dccab11139ad1392dc2f533453abbcc19bd9a0de4ccb5821ada0ed8416099b8910520ebbd7f41502fb9bde3b19792fa73985ff8a44ca845636c11ed9020caca
SSDEEP

768:kdhO/poiiUcjlJInNQuH9Xqk5nWEZ5SbTDaVWI7CPW5o:+w+jjgnbH9XqcnW85SbTsWIA

Score

10^/10

xenorat rat trojan

Malware Config

Extracted

Family

xenorat

C2

172.23.240.1

Mutex

unomutex

Attributes

delay
5000
install_path
nothingset
port
8080
startup_name
wadasd

Targets

- Target
  
  dw.exe
- Size
  
  45KB
- MD5
  
  c3ca905c411c1141d577bf5b10edafb4
- SHA1
  
  0156ed929401995e25c587f85851d44020938406
- SHA256
  
  a13f6a97d4f58a2524b770606f1264578bc94f287105378f5c3fe0f06d21053f
- SHA512
  
  6dccab11139ad1392dc2f533453abbcc19bd9a0de4ccb5821ada0ed8416099b8910520ebbd7f41502fb9bde3b19792fa73985ff8a44ca845636c11ed9020caca
- SSDEEP
  
  768:kdhO/poiiUcjlJInNQuH9Xqk5nWEZ5SbTDaVWI7CPW5o:+w+jjgnbH9XqcnW85SbTsWIA
Score

10^/10

xenorat rat trojan
- XenorRat
  XenorRat is a remote access trojan written in C#.
  trojan rat xenorat
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xenoratrattrojan