Overview

overview

10

Static

static

10

frowning_t....3.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    frowning_tool build 1.3.bin.zip

  • Size

    34KB

  • Sample

    240324-vqtn3sgf6t

  • MD5

    83dff98484b435fcfa03714afc38f414

  • SHA1

    2e61a11eb22b927f0c3607475b8564b4b9ce7588

  • SHA256

    c8d4fa9014587bb65b9bfe3cd7898edc4b0ff214874a9324148a3432ed03d516

  • SHA512

    8a07c980cd884b6ca5fc39bffb4374f35a08c872b49bbd749fdb4944e12599eebd42cdd82e515febf6527ad7dbbabd3367c12d03d0bdd2c6833afa7ff9872562

  • SSDEEP

    768:iEHmvf6DfyBF8xykjnSHAqx2b1GignUYTusqKLxhtgs88:q3AygSgqxkFXsqKfbJ

Score
10/10
xenoratratspywarestealertrojan

Malware Config

Extracted

Family

xenorat

C2

37.120.141.155

Mutex

modtool2

Attributes
  • delay

    5000

  • install_path

    appdata

  • port

    22914

  • startup_name

    WinSCVUpdate

Targets

    • Target

      frowning_tool build 1.3.bin

    • Size

      156KB

    • MD5

      ac0419c1af343890250f5fca61517f9d

    • SHA1

      d9a2685fbc661003b35b18bde3aa8a71e6a8d888

    • SHA256

      98c5b5e5f167fd7ba7a18652c83cbd8d2dfaf52e1dcbcd91853ef9a259042ab0

    • SHA512

      2b6bbe49d57efb14082d1d1bcf23645c3e0ccfbc5f69cc2c6d9df30ef1144b246b93e4ce8d6663afa7ee9ccb4307f52bcf9c37fe212c450846824ce6c7a1a6b1

    • SSDEEP

      1536:EgpHmVauo3mL/pDj6CSYebFNTf43joObhfT7zM:Egp4L/pHvQbFNmjo0FPzM

    Score
    10/10
    xenoratratspywarestealertrojan

    • XenorRat

      XenorRat is a remote access trojan written in C#.

      trojanratxenorat

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks