Extracted

• • Target

    sdsd.bat

  • Size

    399KB

  • MD5

    dedc70c320233bc67ceb02a9492f29d6

  • SHA1

    d031a05a302501a50581a2338762013f60da62df

  • SHA256

    c1836c0d56c8ec60cee58783c67c900f170d854e60f856c1a5b9e001894c8e1a

  • SHA512

    776e753db2a34143981814c44fb0e8bdfa78b38d186ce9e794cd927f28408397460f302d63d731f4c6794cd745164211370b9db7b47b4884d01c5f76f066f93e

  • SSDEEP

    6144:QpmLNVyxXtQ5MtZl5HaSAcfGoPTT5rYwZVYVwmmkcPW0oLCol6w1w/apK0/X0DC:Qga9t8Mt/HA4T9be9mfu0oZ6ziD/EG

  Score

  10^/10

  executionxenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Drops file in System32 directory

  behavioral1behavioral2