Extracted

• • Target

    Odeme_belgesi.exe

  • Size

    241KB

  • MD5

    f5df66951851f33e5035632a77c5a1cf

  • SHA1

    e30fc11bdb5ede3a634b2c0106dc90041b5e6863

  • SHA256

    ff6341544da4fddb3d6b82675a213c2107114f9a5ee57ad963ab38809e467971

  • SHA512

    c0ddea4de3754d196af8096fe6de36e3b672e409cbb4ee46fd4456f3e6236aad9a70dd449a9d1ab4a601195f0c58147cedfb3355ba8b28d0109dfbb735b55d41

  • SSDEEP

    6144:WiZukvpZlYRKu6VgVZJZosZH2I7aoFJpC3C0vArtnQQgUNbfQQUyCXcz1ychrGCm:WaumGgu6VgV/d26aoFJpHiArLgMboQDY

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2