General
-
Target
XenoLauncher.exe
-
Size
45KB
-
Sample
240327-etdh9sce49
-
MD5
2d24883f3fb3ff9ea58f372da291070a
-
SHA1
d2fdd563387cfaaabaa681297a49f26a7ce43d0f
-
SHA256
8fd932b34f74af94e07d3b2ed14b8a3630a30f3c19ebe987fead0e63ae2a4a9b
-
SHA512
6ee0cbe3da9d2d88ce3269c56009217408ea6e73641f4b691b17a2903a2532347ce3666439ece77f7d868d3daa5028133dfd27f4a4beb6024e97e5ac5c32279e
-
SSDEEP
768:SdhO/poiiUcjlJIn/sWH9Xqk5nWEZ5SbTDauuI7CPW5h:0w+jjgnPH9XqcnW85SbTDuIp
Behavioral task
behavioral1
Sample
XenoLauncher.exe
Resource
win7-20240215-en
Malware Config
Extracted
xenorat
127.0.0.1
XenoLauncher
-
delay
5000
-
install_path
temp
-
port
4444
-
startup_name
Discord
Targets
-
-
Target
XenoLauncher.exe
-
Size
45KB
-
MD5
2d24883f3fb3ff9ea58f372da291070a
-
SHA1
d2fdd563387cfaaabaa681297a49f26a7ce43d0f
-
SHA256
8fd932b34f74af94e07d3b2ed14b8a3630a30f3c19ebe987fead0e63ae2a4a9b
-
SHA512
6ee0cbe3da9d2d88ce3269c56009217408ea6e73641f4b691b17a2903a2532347ce3666439ece77f7d868d3daa5028133dfd27f4a4beb6024e97e5ac5c32279e
-
SSDEEP
768:SdhO/poiiUcjlJIn/sWH9Xqk5nWEZ5SbTDauuI7CPW5h:0w+jjgnPH9XqcnW85SbTDuIp
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-