General
-
Target
monkey.exe
-
Size
45KB
-
MD5
5bf8a2aeedfb1123eb10af5e0f0e3302
-
SHA1
cdb9c4090f4ff8b9a5d94eaae30c15f4916e177a
-
SHA256
bf0927a0af35c23071466397ab21b38951d5847a4c7dda419d83a1a98183b12f
-
SHA512
3fa42409cea75c32b6323567fd7f03f10fd220fd73a93e4ba4d6bf998b228377e404d1a050f32e952b742c8d89a7e2384c14129608814711e285bfad33024983
-
SSDEEP
768:FdhO/poiiUcjlJInrVH9Xqk5nWEZ5SbTDazuI7CPW5j:bw+jjgnRH9XqcnW85SbT2uIb
Malware Config
Extracted
xenorat
147.185.221.20
TestingRat
-
install_path
appdata
-
port
3403
-
startup_name
Console
Signatures
-
Xenorat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource monkey.exe
Files
-
monkey.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ