General
-
Target
AuthClient.exe
-
Size
45KB
-
Sample
240327-jlrs5sag4v
-
MD5
de382ff81756934ba776279c448a37b1
-
SHA1
de6741ec906099d79b5c430c210725d534b13440
-
SHA256
6185e375599f40eb19cc5464cd33b388e2b42a0dbf065a67bb395757291d5080
-
SHA512
8be70b011694df2b9031c9483170d8191647a86a843f82d083d0ddd67da4baa25137da3334d1582d5bada4f8e6f3b2d3a13db755d293f2d52aca7aff1aaad73c
-
SSDEEP
768:MdhO/poiiUcjlJInSmH9Xqk5nWEZ5SbTDaIuI7CPW5f:Gw+jjgn5H9XqcnW85SbT1uIn
Behavioral task
behavioral1
Sample
AuthClient.exe
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
AuthClient.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
xenorat
Vallithebest-32755.portmap.host
Xeno_rat_nd8912d
-
delay
2000
-
install_path
appdata
-
port
32755
-
startup_name
AuthClientV2
Targets
-
-
Target
AuthClient.exe
-
Size
45KB
-
MD5
de382ff81756934ba776279c448a37b1
-
SHA1
de6741ec906099d79b5c430c210725d534b13440
-
SHA256
6185e375599f40eb19cc5464cd33b388e2b42a0dbf065a67bb395757291d5080
-
SHA512
8be70b011694df2b9031c9483170d8191647a86a843f82d083d0ddd67da4baa25137da3334d1582d5bada4f8e6f3b2d3a13db755d293f2d52aca7aff1aaad73c
-
SSDEEP
768:MdhO/poiiUcjlJInSmH9Xqk5nWEZ5SbTDaIuI7CPW5f:Gw+jjgn5H9XqcnW85SbT1uIn
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-