Extracted

Extracted

• • Target

    2c6977ae3de5f4439b178da21bd279e3181dfc394eaad65ed1b006dfb3b25d5b.xll

  • Size

    832KB

  • MD5

    8d31657e3cc733753f129c0a8ab9dd35

  • SHA1

    c5d9d5ddba7c1d9ee76c6ee21a5f6dcad1dbe82e

  • SHA256

    2c6977ae3de5f4439b178da21bd279e3181dfc394eaad65ed1b006dfb3b25d5b

  • SHA512

    381adba099f21f6b0ffa1ca70709ea5d3c3d4e7f87dc205b14e947c0c2353988d20c9fcf7732ac46a4e06fe4cfd6aa975c08e8357e2454ef2863fdac63015e34

  • SSDEEP

    12288:jG1N4HkcgMsiOd58bzbBSreWQ0uqZzD1reWabd/aEce45oJNb1qX90YdquL:joOOMX1m+QHT+dCEcelJJ1qtHPL

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2