Extracted

• • Target

    52c06bcb8fad3ada3f6d6eeabff5f2a8fe7876a92bc12b1ff256d6daf1f29e56.exe

  • Size

    242KB

  • MD5

    1c45f9793dcff0da91025fbf5bae5298

  • SHA1

    d314a9f4e2ef9d88dad81726ce7027d26bf4a518

  • SHA256

    52c06bcb8fad3ada3f6d6eeabff5f2a8fe7876a92bc12b1ff256d6daf1f29e56

  • SHA512

    b5756936bbc3076358534628d2df304922857f4cb49d8fa67c06f4f64cc7750315bd6880bd64bfdf6b4cef3bbface162a1a3a1a381f3ca44adb5a8b7a226d9a4

  • SSDEEP

    6144:OYbvMPmf2qbycSe7VeRbypp6yjGi3fw1/h8mCxP2u+WtI:jmmOySY4Gpvd3fa8mCxP2u+WW

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Detects executables packed with ConfuserEx Mod

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2