Extracted

• • Target

    Pago652024.exe

  • Size

    222KB

  • MD5

    8a522f9786f61b5bd677d7a8ed6bd1aa

  • SHA1

    06fdb9d40c9b6448fd8c1a47595eb3e8b3e9ed29

  • SHA256

    e4d55c94e2904333166dc800a24bb13f97f8ceaf8815bbc133f3ac40dd4211f2

  • SHA512

    e79c2be732536b4db756280d889b2021b31396ec669368796d507d7238be27984239d367bf22d9d1dea615b85b5b5b96677a08a383e28272a432988e537deabd

  • SSDEEP

    6144:0kE+cZHhNRHvo14E92D08KHKIpRfvv0upeG2wxywW0pS/i1SbUI:0kpcZB/PoODOEuYG2wxywW0pS/i1SbB

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1