Extracted

Extracted

• • Target

    Odeme_Takvimi_Ocak-2024.xll

  • Size

    832KB

  • MD5

    a18a3a3e81558c30701a5d28fbea50db

  • SHA1

    044a8edc053be2fa5dff2565b4f08906c51f5a91

  • SHA256

    639ef6c263e48a4e6d3c2ffe628c85351d51df4a58955d0fdf64a8764812cca0

  • SHA512

    d6758fefe0955c5be4fa9dada657e61db294b6039d4be1781cc474ba001bbcd131c49102e26fa2f699c77084548c60b29c9dc15a8ab42cef10f779b243600db6

  • SSDEEP

    12288:7G1N4HkcgMsiOd58bzbBSreqQ0uqZzD1reWabd/50+m70avcUthVLFH1Lo:7oOOMX16+QHT+dB0+m70qve

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2