Extracted

• • Target

    Comprobante.exe

  • Size

    180KB

  • MD5

    a5825c821946808fb1f3b22645fbfd9d

  • SHA1

    d0906a55b742bd11e29c2bf6a87dfe3a6dbd547e

  • SHA256

    a340745a55997188efd34c9d83c186de3b899c3b98d05982f327f142deafe790

  • SHA512

    a377a82e2f14909f69958874fd62eec318fd67e266415aa8b6a088c230e7d3fa1833cb8d94dcf660a7c5d6e60817369d10a5694f4577f65b30315a9f91f93043

  • SSDEEP

    3072:+h9LvhVRMQ8at9vMJdr5QckDMV3HycZg8dZuFyjwUZpVTdlRI:tFaj8mMxHy9yQyjwUZpVTdLI

  Score

  10^/10

  xenoratratspywarestealertrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2