Overview

overview

10

Static

static

3

EchoLogger.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    EchoLogger.exe

  • Size

    5.6MB

  • Sample

    240511-xj7y8sfc26

  • MD5

    0b1f4455971b59cd0943b78ac80d1f95

  • SHA1

    54da81385d5d67bfb925ddd7b5dbf2bae923cce5

  • SHA256

    80b98aa859cff943bece9831f7de94656292ff5147db30a9e315ee30553425c2

  • SHA512

    5805d67ab91d32d203433a299943bfde35a65945ebb7861b770c4a00a9adfd3938c6c347e7a1eb120de9240edd2452a0b8d1af9664ff0d6f50cbb4e5ed042c5f

  • SSDEEP

    98304:Y9r1U+si7I0QgV8uPYo/FrjoYPLCr2P5+yvNAyAkkYgGquVIia2kJb8WG9sE68gB:aSUIsV8uASFrjjW0+aAukqZ24zgRm2u2

Score
10/10
xenoratzgratexecutionrattrojan

Malware Config

Extracted

Family

xenorat

C2

jctestwindows.airdns.org

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    5000

  • install_path

    appdata

  • port

    45010

  • startup_name

    ErrorManager

Targets

    • Target

      EchoLogger.exe

    • Size

      5.6MB

    • MD5

      0b1f4455971b59cd0943b78ac80d1f95

    • SHA1

      54da81385d5d67bfb925ddd7b5dbf2bae923cce5

    • SHA256

      80b98aa859cff943bece9831f7de94656292ff5147db30a9e315ee30553425c2

    • SHA512

      5805d67ab91d32d203433a299943bfde35a65945ebb7861b770c4a00a9adfd3938c6c347e7a1eb120de9240edd2452a0b8d1af9664ff0d6f50cbb4e5ed042c5f

    • SSDEEP

      98304:Y9r1U+si7I0QgV8uPYo/FrjoYPLCr2P5+yvNAyAkkYgGquVIia2kJb8WG9sE68gB:aSUIsV8uASFrjjW0+aAukqZ24zgRm2u2

    Score
    10/10
    xenoratzgratexecutionrattrojan

    • Detect ZGRat V1

    • XenorRat

      XenorRat is a remote access trojan written in C#.

      trojanratxenorat

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks