Extracted

• • Target

    AuthClient.exe

  • Size

    45KB

  • MD5

    9f3540bc47fad7d3e44b77bd7d393cb9

  • SHA1

    75a3c191551c6e2383a889e19944999dcaca082e

  • SHA256

    13f183db5e4f7cbdef0673b81f35e99b712c08c6c545152ab0f8ee1ac140a8b5

  • SHA512

    465a5b0f1ddaee38fd5c28cbcc9d69489146a816d3420ed1a7ea2c0f0816b0f9a0b8f40fe88680af324404ed97db95ad8e236d06a2ea144d1c5fc8791f7226c7

  • SSDEEP

    768:7dhO/poiiUcjlJInkwH9Xqk5nWEZ5SbTDaHWI7CPW5p:pw+jjgnFH9XqcnW85SbTOWIh

  Score

  10^/10

  xenoratpersistenceratspywarestealertrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2behavioral3