General
-
Target
0f68c332d1b8248d00a996d4dec0f8e0_NEAS
-
Size
125KB
-
MD5
0f68c332d1b8248d00a996d4dec0f8e0
-
SHA1
1e4eec4339472391053c44ff3c87285c5eecfc3b
-
SHA256
e26efb84ef3e2aff4e003de0261dbd44f0c69a1f1e821ad884b8015f53411e88
-
SHA512
f8cb34fcf4393c2e4773678522003be8af853c76e12ba0bec4408f10dd346f44bb4a2c2bc2f26b99577b4a6a64f01700e391dc058534596909614f3bb3cbd16d
-
SSDEEP
768:Wa/jqPyqisr4dGirXAHg5rbWpwxpFZu9e7Sd/bDXNJb7bTDaHo1IV27gOVQXPS:WeNqwop8pFZu9eKjBJb7bT2o1Igb
Score
10/10
Malware Config
Extracted
Family
xenorat
C2
213.8.116.226
Mutex
Xeno_rat_nd8912d
Attributes
-
delay
5000
-
install_path
nothingset
-
port
4444
-
startup_name
antivirus
Signatures
-
Detects XenoRAT malware 1 IoCs
XenoRAT is an open-source remote access tool (RAT) developed in C#.
-
Xenorat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
0f68c332d1b8248d00a996d4dec0f8e0_NEAS
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections