Extracted

• • Target

    dsf.exe

  • Size

    45KB

  • MD5

    78d4c2bd8fdeca5de7dda407fe6c816b

  • SHA1

    d9a2dd3b6e150c2fba96384cdbec3d08c10c381e

  • SHA256

    e37a490b9054a88c18f41fda4c579a8d2546b790386b98b520bd639c687ba7b2

  • SHA512

    4325dd1c53a9381ba6b34b09342640c6c6ba3db6906128bea810c2d03b485846022c1e790f86e641978cf043b772c070aa403d0f2770b1329360de8331c5b52b

  • SSDEEP

    768:NdhO/poiiUcjlJInOaH9Xqk5nWEZ5SbTDa1uI7CPW5c:Dw+jjgnJH9XqcnW85SbTguIk

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2behavioral3behavioral4