Extracted

• • Target

    33d31a4576721d116977faf9687fb9832e95999d28209aabaed55a24a3d6f581.exe

  • Size

    242KB

  • MD5

    38664a0a401cf3c0fd27e93b4acceee3

  • SHA1

    52d52004dd140bbf60e9abe882c0ee758c38ed58

  • SHA256

    33d31a4576721d116977faf9687fb9832e95999d28209aabaed55a24a3d6f581

  • SHA512

    fba2673d49012caf3e554caa93398bb96c8bd8a93aa51281ec7a5f136b2ebdb99167d0155c4c5e243eb7da81a68d8cbf0ee47900926eaa0164b931d13dfabbf8

  • SSDEEP

    6144:VEopEdkzfA6ON1B6X9T7eKx9EwyZibQ0rlioHd5ZaEb1FWxI:mvdSA6OV6X9lXbmibQ0rliK5ZaEb1FWq

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Detects executables packed with ConfuserEx Mod

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2