Extracted

• • Target

    26f4df13a148ba1754b140207d2f9082ae1c3bcf072166cdcc90375b405c91ed.exe

  • Size

    243KB

  • MD5

    2db1fc0170f4635ce4f364aaa9cb18a3

  • SHA1

    e4ce562b2a8b176f754327ec4e97ba77c2aca866

  • SHA256

    26f4df13a148ba1754b140207d2f9082ae1c3bcf072166cdcc90375b405c91ed

  • SHA512

    ea293a1a0d57ded9b59b30157aecd48e2a30d8372ade7788a20a257c56517f050aba1366a5dc01e50c9f10e4209e3f1ff7ea70c65381477ce792881017e7755c

  • SSDEEP

    6144:bvJz8IL5pqONyDOK6Db/eHK372iA8HOlVpPI:1gZD4qqLa8HOlV6

  Score

  10^/10

  xenoratrattrojan

  • Detects XenoRAT malware

    XenoRAT is an open-source remote access tool (RAT) developed in C#.

    rat

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2