xenorat | 17c89d581521ec69fa8880008fe351f569c063bdf18ce0561c817ff98398c0a1 | Triage

Sharing

General

Target

17c89d581521ec69fa8880008fe351f569c063bdf18ce0561c817ff98398c0a1
Size

155KB
MD5

ba9ca18b95f8985e2ef0b5d8bfe083ea
SHA1

7398827694daa718e6cb6fdd4a32cad6e39be407
SHA256

17c89d581521ec69fa8880008fe351f569c063bdf18ce0561c817ff98398c0a1
SHA512

7c6a93398cb3bcecd0f7d972f8fcd3d53d0043012c84bbd245a68f516567434ed00e9dbca52918b10e83de0202653ffcd6a9df2d6a2c9dfeeae726b768d7cfea
SSDEEP

1536:Fw+jjgn9H9XqcnW85SbTgWIW+ohedcm7DHLwB0Yr7QH7:Fw+jqF91UbTgM+fL7DrXUM

Score

10^/10

xenorat

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

Xeno_rat_nd8912d

Attributes

delay
5000
install_path
appdata
port
4444
startup_name
nothingset

Signatures

Xenorat family
xenorat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17c89d581521ec69fa8880008fe351f569c063bdf18ce0561c817ff98398c0a1

Files

17c89d581521ec69fa8880008fe351f569c063bdf18ce0561c817ff98398c0a1
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ