Extracted

Extracted

• • Target

    ESTADODECUENTA.xll

  • Size

    820KB

  • MD5

    a619cded29da7704aed4a84f24da47b9

  • SHA1

    16bee7cb5587cd14a5937f9f7bc32e6e065ee2fe

  • SHA256

    7b38251641313fb55b8fb461accb8af284d8c2ec11c5da53b306a0e7b3271cdd

  • SHA512

    148b07b8f1b0668e71ab46f15fe7ee41b69c88bb86543f2def6f7ffa3614d7d61268d5450c0cfe7535f8900d86074143ad6cecb5b98b6c7d9bbd64c8bc6656c0

  • SSDEEP

    12288:1G1N4HkcgMsiOd58bzbBSre6Q0uqZzD1reWabd/dbNZEEx/DLn0vkYHipwyA:1oOOMX1K+QHT+d9NZdxYHip

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2