Overview

overview

10

Static

static

10

sa.exe

windows7-x64

10

sa.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    sa.exe

  • Size

    310KB

  • MD5

    64a3cb4713a64a85a07a28878c50fb55

  • SHA1

    5a8fdb5b2e5338db3b2b81949b30ca0edc483d4e

  • SHA256

    8ff9cd217cac6f44e24e5de2049f4289d05286dfbf32566b70c0744dbdd6d381

  • SHA512

    46aa9ba21ed7afb453ea474731f7fbe8b68848b97887746d95a8df2eb4dcd469febc6e566c099cc18b080added707964c771479c5c6130ef404e5d13ce72bc0a

  • SSDEEP

    6144:aW+91UbIeC+5r6PmRIoS5P7xVEDc7SuDSSwb:a7eCB9V5b

Score
10/10
xenorat

Malware Config

Extracted

Family

xenorat

C2

192.168.56.1

Mutex

Growtopia_4232

Attributes
  • delay

    5000

  • install_path

    appdata

  • port

    4444

  • startup_name

    growtopia

Signatures

  • Xenorat family
    xenorat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • sa.exe
    .exe windows:4 windows x86 arch:x86

    Password: 1234

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections