Extracted

• • Target

    6e0ec890c9d772cfc103b7adc1b99040_NeikiAnalytics

  • Size

    310KB

  • MD5

    6e0ec890c9d772cfc103b7adc1b99040

  • SHA1

    85ba34aeaaeb4ea210335e8358e403a26101e916

  • SHA256

    4f75082e47f4a8c28bdb99a2f167d0ec26fd634a7f96b3e187740595ed647599

  • SHA512

    447dca87a68ae91df7d7c314c9ffa872ba865c06b26cac5b1629e59c5ddc9789c52324e5d1542918bb1c1acee429504f9c2a98ccc0f50540861fbd25c3d3a906

  • SSDEEP

    1536:xw+jjgnXlF2I8H9XqcnW85SbTOuIaetehjriQJ17REBwGbOqzJDRDTNybdUEOMhx:xw+jqXlFfG91UbTOVSiVGpqPY3wA

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2