xenorat | c01236d7be0ab4e31278d02559a12b8a0711144f26d37c6919375022964eba95

Resubmissions

12/04/2024, 16:12 UTC

240412-tnhy5aca34 10

12/04/2024, 06:12 UTC

240412-gx6ekagc94 10

Sharing

Copy URL

Twitter E-mail

General

Target

ok.exe
Size

45KB
Sample

240412-gx6ekagc94
MD5

2d16646ae88e5979ab98de7a372337c8
SHA1

dd91c79b53194fa45c78df96d0bd594a35c1508e
SHA256

c01236d7be0ab4e31278d02559a12b8a0711144f26d37c6919375022964eba95
SHA512

ad61921a8f87ce17c0d4b0a481632ff310e1f150022213094a0844cd06f7942f85685aebc758e4bac368bc2c2f7422618638ab7adbc4e10caf7ed14eba3184ff
SSDEEP

768:NdhO/poiiUcjlJInDwH9Xqk5nWEZ5SbTDa0WI7CPW5c:Dw+jjgn0H9XqcnW85SbTlWIk

Score

10^/10

Malware Config

Extracted

Family

xenorat

fe80::48a6:2b8e:4540:36b9%6

Mutex

Xeno_rat_nd8912d

Attributes

delay
5000
install_path
appdata
port
4444
startup_name
SysUpd

Targets

- Target
  
  ok.exe
- Size
  
  45KB
- MD5
  
  2d16646ae88e5979ab98de7a372337c8
- SHA1
  
  dd91c79b53194fa45c78df96d0bd594a35c1508e
- SHA256
  
  c01236d7be0ab4e31278d02559a12b8a0711144f26d37c6919375022964eba95
- SHA512
  
  ad61921a8f87ce17c0d4b0a481632ff310e1f150022213094a0844cd06f7942f85685aebc758e4bac368bc2c2f7422618638ab7adbc4e10caf7ed14eba3184ff
- SSDEEP
  
  768:NdhO/poiiUcjlJInDwH9Xqk5nWEZ5SbTDa0WI7CPW5c:Dw+jjgn0H9XqcnW85SbTlWIk
Score

10^/10

xenorat rat trojan
- XenorRat
  XenorRat is a remote access trojan written in C#.
  trojan rat xenorat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

XenorRat

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

We care about your privacy.