Extracted

• • Target

    fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7.exe

  • Size

    242KB

  • MD5

    33f2e874128d3a24588e1c89927042bd

  • SHA1

    e206af96ff648951608eaf599627635ddff7ecd8

  • SHA256

    fbb251f9916a362e527e962c4e2b0950f75de2226f3e3092813fa35eb6392bb7

  • SHA512

    559dc3f6a0f9a6e762545b9683e265e4459b8623786c979c959d5d78dff7f4455fed72135fcccc966c10ba3d3588fcbf077a44091e3012743245dc41bfd1b3c5

  • SSDEEP

    6144:gRRan2neJf5QvtapiSgICS86G3vsMP1i8FvEOPDv5bq1RFI:gRTeJf5mappgICS+3xPFvrPDv5bq1I

  Score

  10^/10

  xenoratrattrojan

  • Detects XenoRAT malware

    XenoRAT is an open-source remote access tool (RAT) developed in C#.

    rat

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2