Extracted

• • Target

    55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872.exe

  • Size

    243KB

  • MD5

    2bd233b4d1cb93a0971748e038f7d5f4

  • SHA1

    165447a2f77ea24155cd59afd2681f8703a52141

  • SHA256

    55066b9bf6963a3459417d3056ecbd6b7f875168e6d11885f8506c19ddbd9872

  • SHA512

    1b1a6ac49146cf6ffdb648ff1c7da6b66de1fb40ee056f12d9a5ec69cdcc00911567a6c6f82d504a654234c2fbc5fca2417d8c94437e0a6d65587aee0b009bd2

  • SSDEEP

    6144:egh4hBiHKmDvP9hINHpcZ8S+jqv0LatcNAoYoBei/my3PQSeMQSI:cCqmj9SmKjqyatcN+4/my3PQSeMQX

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Detects executables packed with ConfuserEx Mod

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2