Analysis
-
max time kernel
141s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
07-05-2024 04:53
General
-
Target
6b35e59ba5327c657edd793620278a00_NEAS.exe
-
Size
39KB
-
MD5
6b35e59ba5327c657edd793620278a00
-
SHA1
c4ffc82322f136a5d56b500f66a9fbffecbcc7a0
-
SHA256
326655c480a480f47f88d6282f116e3144273114f36de1d5bd8bb1c251f21cdc
-
SHA512
ef949f35a04fe27ec7f1f4021543783c3193b10a50f07877b162e50af4b3934410c4ae135a29a4d296c172d46ccd482e92028d396276cb0c5011a6adc48aa355
-
SSDEEP
768:q1u2l/LK/8yqdlfIzzQlbS6m/a3bnn2alRPPEs1jj5U:H6oSPYzGS6maz2alFEW5U
Score
10/10
Malware Config
Extracted
Family
xenorat
C2
localhost
Mutex
testing 123123
Attributes
-
delay
1000
-
install_path
nothingset
-
port
1234
-
startup_name
nothingset
Signatures
-
Detects XenoRAT malware 1 IoCs
XenoRAT is an open-source remote access tool (RAT) developed in C#.
-
XenorRat
XenorRat is a remote access trojan written in C#.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b35e59ba5327c657edd793620278a00_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\6b35e59ba5327c657edd793620278a00_NEAS.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB