xenorat | 0x000700000002327c-112[.]dat | Triage

Sharing

General

Target

0x000700000002327c-112.dat
Size

45KB
MD5

838b98ebbd662c0f4e5cc5cbcafa2cfa
SHA1

58ff94e92c2548f87a9284a0ac5cea0d472309e0
SHA256

5649336f36c1479f2b2a499a7555743579c4d0ec64ffdaf41c8d8090ae94964a
SHA512

a4505475953c0bb5614bc0468defdc550401e758230d8b9c65332aed2f07a7f31ba968d462718a6bf2de825903d84203946e8c085edceb6148fae88b1a48233c
SSDEEP

768:ZdhO/poiiUcjlJInyHqH9Xqk5nWEZ5SbTDadWI7CPW5Q:Xw+jjgnVH9XqcnW85SbTEWI4

Score

10^/10

xenorat

Malware Config

Extracted

Family

xenorat

C2

puredgb.duckdns.org

Mutex

Xeno_rat_nd8912d

Attributes

delay
5000
install_path
appdata
port
4444
startup_name
Fobus.exe

Signatures

Xenorat family
xenorat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0x000700000002327c-112.dat

Files

0x000700000002327c-112.dat
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ