Extracted

• • Target

    Downlaoder_Menu.exe

  • Size

    4.5MB

  • MD5

    ec79983fdb605310fac832ba5809e2d6

  • SHA1

    ca83d6453563e02decf614d0ce331de493267d2f

  • SHA256

    b67d8fc52334fb2309368bf2a738520f1b42436951b211b7896f612b86350c10

  • SHA512

    234bb8696c8a6929784165366dc4317d5826738711a7661bf26e4ffab8e958db23d0f2a11542b3f0b5c4c71d62d3e4bc7a730d94d917a21d132d40e2a67ed460

  • SSDEEP

    98304:ePj50PrsilC2IbhblAh5+dWspirADIsYAVjw1gI:i5gahZWs80sfsw1R

  Score

  10^/10

  xenoratexecutionrattrojanxmrigevasionminerupx

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Drops file in Drivers directory

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2