xenorat | f727ddfdf7e802969f8f792e8101ce3f39803fc2e7306f4c93f94f37dce00bc5 | Triage

Sharing

General

Target

2024-05-07_7dacc5f705f4773fb1bd5711977b6a4b_ngrbot_snatch
Size

5.4MB
Sample

240507-jcmstseh2w
MD5

7dacc5f705f4773fb1bd5711977b6a4b
SHA1

bef4451f4bf5a2c72f3505a282551606c31b94f8
SHA256

f727ddfdf7e802969f8f792e8101ce3f39803fc2e7306f4c93f94f37dce00bc5
SHA512

700d23c17968779b52529047c7c73b7d21f2baf4e81672054ae8b552f37a02ba8be543f51e85a63badc3b5c0567833963b717359c2bb4a2d49a3c1f12f0753a6
SSDEEP

49152:ALkjoWYAUZzhXjF/exacTv4U+SbNmuP30ntABdqju5EsiMllYBNC83OnQlds:AodYAUZz1RYvFNDPEtQ5EsOB+n0s

Score

10^/10

xenorat evasion execution rat trojan

Malware Config

Extracted

Family

xenorat

C2

69.46.15.141

Mutex

Xeno_rat_nd8912d

Attributes

delay
5000
install_path
nothingset
port
4444
startup_name
nothingset

Targets

- Target
  
  2024-05-07_7dacc5f705f4773fb1bd5711977b6a4b_ngrbot_snatch
- Size
  
  5.4MB
- MD5
  
  7dacc5f705f4773fb1bd5711977b6a4b
- SHA1
  
  bef4451f4bf5a2c72f3505a282551606c31b94f8
- SHA256
  
  f727ddfdf7e802969f8f792e8101ce3f39803fc2e7306f4c93f94f37dce00bc5
- SHA512
  
  700d23c17968779b52529047c7c73b7d21f2baf4e81672054ae8b552f37a02ba8be543f51e85a63badc3b5c0567833963b717359c2bb4a2d49a3c1f12f0753a6
- SSDEEP
  
  49152:ALkjoWYAUZzhXjF/exacTv4U+SbNmuP30ntABdqju5EsiMllYBNC83OnQlds:AodYAUZz1RYvFNDPEtQ5EsOB+n0s
Score

10^/10

xenorat evasion execution rat trojan
- XenorRat
  XenorRat is a remote access trojan written in C#.
  trojan rat xenorat
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

xenoratevasionexecutionrattrojan