xenorat | 072cfa70f4e6da9ae163db6fa1a6cd53f37f3abbd1112fc325eea410eddfec8e | Triage

Sharing

General

Target

SUBZ_RENAME_THIS.exe
Size

45KB
Sample

240617-1q284svhlh
MD5

3e2252afbdb1dd02a77f81230aa7ec1d
SHA1

8d97476cd2246813aa03bab9594afb4d01afef4a
SHA256

072cfa70f4e6da9ae163db6fa1a6cd53f37f3abbd1112fc325eea410eddfec8e
SHA512

f9add489c68cdf0ea0b3a96f7985ae0087326f4c6eda84502a40b67bb15580de2cd58f7c6f3ffae1644acbe4da354c9b075d12d56d30f62de33bfabbf8aee807
SSDEEP

768:hdhO/poiiUcjlJInvvH9Xqk5nWEZ5SbTDaJWI7CPW55:fw+jjgn3H9XqcnW85SbTAWIR

Score

10^/10

xenorat rat trojan

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

Xeno_rat_nd8912d

Attributes

delay
5000
install_path
nothingset
port
4444
startup_name
nothingset

Targets

- Target
  
  SUBZ_RENAME_THIS.exe
- Size
  
  45KB
- MD5
  
  3e2252afbdb1dd02a77f81230aa7ec1d
- SHA1
  
  8d97476cd2246813aa03bab9594afb4d01afef4a
- SHA256
  
  072cfa70f4e6da9ae163db6fa1a6cd53f37f3abbd1112fc325eea410eddfec8e
- SHA512
  
  f9add489c68cdf0ea0b3a96f7985ae0087326f4c6eda84502a40b67bb15580de2cd58f7c6f3ffae1644acbe4da354c9b075d12d56d30f62de33bfabbf8aee807
- SSDEEP
  
  768:hdhO/poiiUcjlJInvvH9Xqk5nWEZ5SbTDaJWI7CPW55:fw+jjgn3H9XqcnW85SbTAWIR
Score

10^/10

xenorat rat trojan
- XenorRat
  XenorRat is a remote access trojan written in C#.
  trojan rat xenorat
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

xenoratrattrojan

behavioral2

xenoratrattrojan