Static

static

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    gff.exe

  • Size

    45KB

  • MD5

    b0d79046b9de684d5ae769f23770bf98

  • SHA1

    05a104387fca5c81cb6b36375df6046320fa1491

  • SHA256

    e36ebe0f487a6b37a54c688bce8be1e5328b187cf1e25703dfd4490309a0c997

  • SHA512

    18f8f10b1ea018c9b2a303e1e8999ba304a2f17be92fe3d5d0fa91785e2edb8317efdace35781225014421efa8a7e5a47b922fa68468ae9fdb881ba0783bf8c6

  • SSDEEP

    768:hdhM/poiiUcjlJInvI/f9Xqk5nWEZ5SbTDau5I7CPW5t:f2+jjgnA/f9XqcnW85SbTT5IF

Score
10/10
xenorat

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    5000

  • install_path

    nothingset

  • port

    4444

  • startup_name

    nothingset

Signatures

  • Xenorat family
    xenorat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • gff.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections