Extracted

• • Target

    a3254b90b2c6e12c29f7d9f538087da2d4bb7f64d003c591c8936cee7dd74b39

  • Size

    45KB

  • MD5

    4091b1844d11374da445542dae37c305

  • SHA1

    029f3396c39f543dd984031eb82edcc035ed0a25

  • SHA256

    a3254b90b2c6e12c29f7d9f538087da2d4bb7f64d003c591c8936cee7dd74b39

  • SHA512

    c0a7709ed26d1643776dddb992fdf4910247da5b7548b1780212ad7183bc295a58832243d99ea68e84807ad4db4d5895dcec79f32f3464a1a97ba6ae02d447eb

  • SSDEEP

    768:5dhO/poiiUcjlJIn1sPH9Xqk5nWEZ5SbTDaLluI7CPW5o:3w+jjgnGPH9XqcnW85SbTEuIg

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2