Extracted

• • Target

    RegistryHelper.exe

  • Size

    46KB

  • MD5

    d7916e968a167b3054cb3078debb1fc4

  • SHA1

    35b69b95699451453715b8f6963b18c5909ee665

  • SHA256

    8fc30212418d834f5072dea6843fac92a080d10c33fc2a108bdc0d1183dc3c90

  • SHA512

    3a9bb21e887cc2a0d5d7ebd04698287100d66173cbe199537a2bc47a6f632da6e5f1db9f95597bb68836614d435da100f7196edc435eb2d97a04187d8bbc4487

  • SSDEEP

    768:fdhO/poiiUcjlJIn3sPH9Xqk5nWEZ5SbTDanuI7CPW5S:Vw+jjgn8PH9XqcnW85SbT6uIa

  Score

  10^/10

  xenoratpersistenceratspywarestealertrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Modifies Installed Components in the registry

    persistence

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2