Behavioral task
behavioral1
Sample
9fbc285f7b604f892f4eb19c55302215cb5ec976a1eb06d9424335894bc08055.exe
Resource
win7-20240221-en
General
-
Target
9fbc285f7b604f892f4eb19c55302215cb5ec976a1eb06d9424335894bc08055
-
Size
45KB
-
MD5
a96c296b9891507e5119f0620086677b
-
SHA1
5db23b067df67a6b45c64081f46d7f196ca6045f
-
SHA256
9fbc285f7b604f892f4eb19c55302215cb5ec976a1eb06d9424335894bc08055
-
SHA512
9440621c8db67237861638b6ac95f746209093115265ee74a7b62aff9241b03d96527aa5a73ae958c3668d96b183010144f441c34476a0a2cdfb53516b05889e
-
SSDEEP
768:ndhO/poiiUcjlJInbQuH9Xqk5nWEZ5SbTDaRWI7CPW5D:dw+jjgnZH9XqcnW85SbToWIL
Malware Config
Extracted
xenorat
127.0.0.1
AXISWARE
-
delay
5000
-
install_path
temp
-
port
1234
-
startup_name
User
Signatures
-
Xenorat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9fbc285f7b604f892f4eb19c55302215cb5ec976a1eb06d9424335894bc08055
Files
-
9fbc285f7b604f892f4eb19c55302215cb5ec976a1eb06d9424335894bc08055.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ