D:\Armin\Creds\HK\New\tools\xeno-rat-1.8.7\xeno rat client\obj\Release\managing_app.pdb
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
6d17c1806be4d9832e6e5338f75d5cb6b378a0a3575e49737015a97a82d8b7ba.exe
Resource
win7-20240220-en
General
-
Target
6d17c1806be4d9832e6e5338f75d5cb6b378a0a3575e49737015a97a82d8b7ba
-
Size
42KB
-
MD5
0c57b1c60b932bbf4da550529ca05f45
-
SHA1
a29674e09d3fa3a92a27bb52d89a97849f24e469
-
SHA256
6d17c1806be4d9832e6e5338f75d5cb6b378a0a3575e49737015a97a82d8b7ba
-
SHA512
501bcc98af5b322ff5c5e16d8426c969054a9bf3104b90b7f39e2e0d76c1327f5ce73abb4805a4059ac513a34a5382e2a79494c4a8fd50889e4a3e4fbe981d0e
-
SSDEEP
768:omgegwHE3MrhLHWB+MP0RSii/tOsWp+Y9AUkd8EMqGfA95GVjpG:oBe1EcrRHuGN54ukd8EMqbmTG
Malware Config
Extracted
xenorat
localhost
testing 123123
-
delay
1000
-
install_path
nothingset
-
port
1234
-
startup_name
nothingset
Signatures
-
Xenorat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6d17c1806be4d9832e6e5338f75d5cb6b378a0a3575e49737015a97a82d8b7ba
Files
-
6d17c1806be4d9832e6e5338f75d5cb6b378a0a3575e49737015a97a82d8b7ba.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ