Extracted

• • Target

    4b25b70180a66fc9112ea0dc57fe2778d204a3327980717f66bed1290767d19a

  • Size

    241KB

  • MD5

    9cd296f29d513c5d8b8aa64379b877ea

  • SHA1

    cccb6576c574d37673f468a850e6227254a4c9bc

  • SHA256

    4b25b70180a66fc9112ea0dc57fe2778d204a3327980717f66bed1290767d19a

  • SHA512

    3d8c36a2bf84ea5bd749af0a5fcbe4dc44211fb2f2c588d40e720f42bff9bf0b3781c940af6c2fd4a0ede730df51f01065bd07b27e7125f7971fe3e17f5c717e

  • SSDEEP

    6144:Gy9PRDmba+XD7nn/TbCCdVhd/AarhwmcCLQa1GwWBVhQoI:Ca+XD7/TbXdPRAatzcfa1GwWBVhQV

  Score

  10^/10

  xenoratratspywarestealertrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2