Overview

overview

10

Static

static

10

htrh.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    htrh.exe

  • Size

    45KB

  • Sample

    240430-3xjrfscg92

  • MD5

    1fd8b76998446e36a2608d9c58befe46

  • SHA1

    6d2c6d5cb3ed6542cce48f09f1ad0c7ed0b242f6

  • SHA256

    7a0d2fa38d41972ef26d4909f4079ea8f4ddaa06394caa4c06937cd933c175ea

  • SHA512

    b0198d4c15726d4b196e7b5ca8b11c6546e21c5800179e1e089ffcc6f822e274bd2e1510f67a5dd230eb6dedaf715320f2c31b3101f76b574b2ece75ba5fd5aa

  • SSDEEP

    768:3dhO/poiiUcjlJInionH9Xqk5nWEZ5SbTDafWI7CPW5D:tw+jjgnVnH9XqcnW85SbTWWI7

Score
10/10
xenoratrattrojan

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

VapePatcher

Attributes
  • delay

    5000

  • install_path

    appdata

  • port

    9999

  • startup_name

    Minecraft Launcher

Targets

    • Target

      htrh.exe

    • Size

      45KB

    • MD5

      1fd8b76998446e36a2608d9c58befe46

    • SHA1

      6d2c6d5cb3ed6542cce48f09f1ad0c7ed0b242f6

    • SHA256

      7a0d2fa38d41972ef26d4909f4079ea8f4ddaa06394caa4c06937cd933c175ea

    • SHA512

      b0198d4c15726d4b196e7b5ca8b11c6546e21c5800179e1e089ffcc6f822e274bd2e1510f67a5dd230eb6dedaf715320f2c31b3101f76b574b2ece75ba5fd5aa

    • SSDEEP

      768:3dhO/poiiUcjlJInionH9Xqk5nWEZ5SbTDafWI7CPW5D:tw+jjgnVnH9XqcnW85SbTWWI7

    Score
    10/10
    xenoratrattrojan

    • XenorRat

      XenorRat is a remote access trojan written in C#.

      trojanratxenorat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks