Extracted

• • Target

    optimiser.exe

  • Size

    431KB

  • MD5

    74cb80305f51ff0585928c12be72dddd

  • SHA1

    727a72de8f439beebf028f21d3cb58f45f99e42a

  • SHA256

    a94a79df8c332ae5de59b99853ae97dc8a1fc272818a146bd7ad1d5e295611c5

  • SHA512

    21775770e10ae19302d198d7c48799bc510aee0c7e92563798ba151760181facc6ba9452400cde84e3018881ec1a54ac82d1fd9b587c4bc2305af3b5793cf178

  • SSDEEP

    12288:9uBadWfqCQi/szyz7FaFAf69ffou1R1L:9iadWfEssOzZusmPR

  Score

  10^/10

  executionxenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2