Extracted

• • Target

    d604951103c680eed0a0e42b1c6cc956b272a8dbdcc677c3d7c54b9a27ae033b.exe

  • Size

    243KB

  • MD5

    78e1f12f7a7d369fe3b2f265dc740ae4

  • SHA1

    b5b56cf24ee4cbb441a06b332f6c1d53adeed1b1

  • SHA256

    d604951103c680eed0a0e42b1c6cc956b272a8dbdcc677c3d7c54b9a27ae033b

  • SHA512

    6526bfeed5b0ba4aadff842ab044e006c1d70869287b06e721b65cbad90f7b86871cc0b72d554f3a47ded715fc3c2f9c81b2e939b9c039b483170809bf4a6f47

  • SSDEEP

    6144:zu7HjwLO0hyT7YQGEhOy+q2bVPEX2BYGpNTI:z08LunYQ5hb2bVPEX2BYGpi

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Detects executables packed with ConfuserEx Mod

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2