Extracted

• • Target

    3f2490dd9d05980a4b02f6b5e6e9c18f349cc4192a4733374318c20bc7f0a885.exe

  • Size

    242KB

  • MD5

    f36fa3a72893c4151b136426119ad589

  • SHA1

    2f83d91056d831a40182c743c36fab2622be8906

  • SHA256

    3f2490dd9d05980a4b02f6b5e6e9c18f349cc4192a4733374318c20bc7f0a885

  • SHA512

    fa51532d7257fb7e71a2f5f9091350086c1772dc5458b572674071c25288b80b205bf17db271e58e11e45d930f4c1745938e45068125bf92b29fd8ca3e6859ff

  • SSDEEP

    6144:hcBzA6kEHVMRfmlOSdqadv5fdvW5S7w1ofkPAyDEqClNdzI:SBTkEHS8dqidvL7/cPAyDEqClN6

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Detects executables packed with ConfuserEx Mod

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2