Analysis
-
max time kernel
141s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
07-05-2024 02:41
General
-
Target
52ca99402ec68c4334e6a97089a62c30_NEAS.exe
-
Size
28KB
-
MD5
52ca99402ec68c4334e6a97089a62c30
-
SHA1
5c0872f6d2654b14db17ed98006d344024af42b4
-
SHA256
fcba6fc8df6843c48103b107e9325066db386f32d1325fd4c70964156606f373
-
SHA512
a07ae0f8fb812d3f97667a0be8441d6bb5ba50ec3da6cac99e5e8ae36c1fbdbdf08598303b6efd6e105e950edd7e93ffb0a5c06cba6d87086f77f2b6a9f0e6b5
-
SSDEEP
384:zHlfOeW4p9XIh6dMEkRQvz1HTxbMeXiRdagkZ3UQ6Bbv0dIGdMEjeC96jrV6NtJO:zFfOeW4p9XkEkRC1bv9RpReCojAO
Score
10/10
Malware Config
Extracted
Family
xenorat
C2
localhost
Mutex
testing 123123
Attributes
-
delay
1000
-
install_path
nothingset
-
port
1234
-
startup_name
nothingset
Signatures
-
Detects XenoRAT malware 1 IoCs
XenoRAT is an open-source remote access tool (RAT) developed in C#.
-
XenorRat
XenorRat is a remote access trojan written in C#.
Processes
-
C:\Users\Admin\AppData\Local\Temp\52ca99402ec68c4334e6a97089a62c30_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\52ca99402ec68c4334e6a97089a62c30_NEAS.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB