Extracted

• • Target

    5a74ace81656d018cc01e7db0cf24abe072524df6c297fa2081019e89680e5e1.exe

  • Size

    242KB

  • MD5

    eebe7da6234f15c2055ddff4b4da6948

  • SHA1

    76dc426d92a7785677d2ab1ac4cf7c1a63f6af48

  • SHA256

    5a74ace81656d018cc01e7db0cf24abe072524df6c297fa2081019e89680e5e1

  • SHA512

    0e088d5892921d67df1703f5e958a549b32fee13865af459212c0b6fd2f928b8f0534dccf17c1727d7e4fcb6162d90085736f3d58ba801c2fd285d8a9c01abd8

  • SSDEEP

    6144:F1gj4ZzsyX3tzfeVcVz3xkQm3S4eWwNZE3UJxI:F1gj4J7feV6Zr9NZE3UJq

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Detects executables packed with ConfuserEx Mod

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2