Overview

overview

10

Static

static

10

2968-8-0x0...ry.exe

windows7-x64

2968-8-0x0...ry.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2968-8-0x0000000000400000-0x0000000000412000-memory.dmp

  • Size

    72KB

  • MD5

    763de88d8c4abb27db7ad5931bc32950

  • SHA1

    cb57f860045bf94e83ffeb5091e60b47f6f9683f

  • SHA256

    ea8215c7e9f85756fb93c64485a42aef506cdda769926324e542d566e2ff53e4

  • SHA512

    5d0c402104f31ea7c3958bebb907e1bfea08b38bb091ad8c18b0baf0147f07f2b617c94cb12e4470cc9f7bc64fbfa4440eb863170abc23e2b03a175dfceca0d4

  • SSDEEP

    768:0SisJmceOokD7vcgspLfFpyT7QHbtm+tkyqnN+8NG:GsJmfOzD7kXprj4QHbtZkH4UG

Score
10/10
xenorat

Malware Config

Extracted

Family

xenorat

C2

dns.requimacofradian.site

Mutex

Xeno_rat_nd8818g

Attributes
  • delay

    60000

  • install_path

    appdata

  • port

    1243

  • startup_name

    uic

Signatures

  • Xenorat family
    xenorat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2968-8-0x0000000000400000-0x0000000000412000-memory.dmp
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections