Extracted

• • Target

    Transaccion_Recibos.xls

  • Size

    50KB

  • MD5

    c9c6a2b1c94755b93d6200923889827a

  • SHA1

    6de6e84b0c47ff3e816f1eea74be33c2b2b88d71

  • SHA256

    40ec6278632cd557b1b4a71756f605cd1579e1c54f1534c74f15751199fd521c

  • SHA512

    c9ab930fb4c792403a842441093e18a28a33a06773d2fad2dc705e51d477c159781922c16eee056cc0409b4aa496738d201e456a573e24a58989c44904f0411b

  • SSDEEP

    1536:VrxEtjPOtioVjDGUU1qfDlaGGx+cL2QnABIS49hhUT6SPDLktw:VrxEtjPOtioVjDGUU1qfDlaGGx+cL2Q

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2