Overview

overview

10

Static

static

10

unlocked-gen.exe

windows7-x64

10

unlocked-gen.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    unlocked-gen.bat

  • Size

    45KB

  • Sample

    240525-a8p4dsha73

  • MD5

    d2db2b350e07ac3555b415ad0ef7273e

  • SHA1

    eb95cf23d1cd315d99d64ba61d1cc2f5f7bd76a6

  • SHA256

    53bb0c771cfaaf16a7409a8b921c9e7e1595d281d94f5e7ad54454b3b5ac1602

  • SHA512

    85778d717fc5315d5cd8898836d73fd735d9be2bbb409fa1ae5be3b79097664378779d2a4db3c1895fd2cadf01d3cdbc465e4f8a6186aac969acceeaa591458e

  • SSDEEP

    768:hdhO/poiiUcjlJInXtUH9Xqk5nWEZ5SbTDaQWI7CPW5k:fw+jjgn9UH9XqcnW85SbTxWI8

Score
10/10
xenoratrattrojan

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    3000

  • install_path

    temp

  • port

    3389

  • startup_name

    system

Targets

    • Target

      unlocked-gen.bat

    • Size

      45KB

    • MD5

      d2db2b350e07ac3555b415ad0ef7273e

    • SHA1

      eb95cf23d1cd315d99d64ba61d1cc2f5f7bd76a6

    • SHA256

      53bb0c771cfaaf16a7409a8b921c9e7e1595d281d94f5e7ad54454b3b5ac1602

    • SHA512

      85778d717fc5315d5cd8898836d73fd735d9be2bbb409fa1ae5be3b79097664378779d2a4db3c1895fd2cadf01d3cdbc465e4f8a6186aac969acceeaa591458e

    • SSDEEP

      768:hdhO/poiiUcjlJInXtUH9Xqk5nWEZ5SbTDaQWI7CPW5k:fw+jjgn9UH9XqcnW85SbTxWI8

    Score
    10/10
    xenoratrattrojan

    • XenorRat

      XenorRat is a remote access trojan written in C#.

      trojanratxenorat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks