Extracted

• • Target

    9fbc285f7b604f892f4eb19c55302215cb5ec976a1eb06d9424335894bc08055

  • Size

    45KB

  • MD5

    a96c296b9891507e5119f0620086677b

  • SHA1

    5db23b067df67a6b45c64081f46d7f196ca6045f

  • SHA256

    9fbc285f7b604f892f4eb19c55302215cb5ec976a1eb06d9424335894bc08055

  • SHA512

    9440621c8db67237861638b6ac95f746209093115265ee74a7b62aff9241b03d96527aa5a73ae958c3668d96b183010144f441c34476a0a2cdfb53516b05889e

  • SSDEEP

    768:ndhO/poiiUcjlJInbQuH9Xqk5nWEZ5SbTDaRWI7CPW5D:dw+jjgnZH9XqcnW85SbToWIL

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2