Extracted

• • Target

    3087ed281ceea401aaf8fbd45b1d8fd6d384d48d3b097dd540162efa6931727f.exe

  • Size

    242KB

  • MD5

    83e7f4ab1716acc476ec084ce84861a1

  • SHA1

    64e8e30193ad042474c157865f8938d101fa4f80

  • SHA256

    3087ed281ceea401aaf8fbd45b1d8fd6d384d48d3b097dd540162efa6931727f

  • SHA512

    3958276eded5fc7b18c418b686a643f09b4a0025c87d2bf15e66b07ffd5c1ad86467a4c9b201ca1cd619a18d334ab92ed2dbb071d7ff9adb9209793403e9747f

  • SSDEEP

    6144:IpB37AhZUYolzBt09nG29wiGjTLxTiaUmWdShuTcC8ZRfdnTI:I33sONvunqPnBi6WkhuTcC8ZRfdU

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Detects executables packed with ConfuserEx Mod

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2