xenorat | 52ca99402ec68c4334e6a97089a62c30_NEAS | Triage

Sharing

General

Target

52ca99402ec68c4334e6a97089a62c30_NEAS
Size

28KB
MD5

52ca99402ec68c4334e6a97089a62c30
SHA1

5c0872f6d2654b14db17ed98006d344024af42b4
SHA256

fcba6fc8df6843c48103b107e9325066db386f32d1325fd4c70964156606f373
SHA512

a07ae0f8fb812d3f97667a0be8441d6bb5ba50ec3da6cac99e5e8ae36c1fbdbdf08598303b6efd6e105e950edd7e93ffb0a5c06cba6d87086f77f2b6a9f0e6b5
SSDEEP

384:zHlfOeW4p9XIh6dMEkRQvz1HTxbMeXiRdagkZ3UQ6Bbv0dIGdMEjeC96jrV6NtJO:zFfOeW4p9XkEkRC1bv9RpReCojAO

Score

10^/10

rat xenorat

Malware Config

Extracted

Family

xenorat

C2

localhost

Mutex

testing 123123

Attributes

delay
1000
install_path
nothingset
port
1234
startup_name
nothingset

Signatures

Detects XenoRAT malware 1 IoCs

XenoRAT is an open-source remote access tool (RAT) developed in C#.

resource	yara_rule
sample	XenoRAT

Xenorat family
xenorat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
52ca99402ec68c4334e6a97089a62c30_NEAS

Files

52ca99402ec68c4334e6a97089a62c30_NEAS
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Armin\Creds\HK\New\tools\xeno-rat-1.8.7\xeno rat client\obj\Release\managing_app.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ