Extracted

• • Target

    test.exe

  • Size

    45KB

  • MD5

    fb6a501b93be4706521d089b6f19e50f

  • SHA1

    39c6cd822a768edabeae098959474f0b7ed73bdb

  • SHA256

    658fc754755da07407dd615593df8418974ac01644aaa114c89000fe3583b2b7

  • SHA512

    897fc37ed1b6b403c1fee909ba5ff6a67cfbf83b4d9d7be2c9f00b3ab4e458637420edd14c26d4673b8271ba3176261a03864ddeb86e82c67869f41b79ce5d39

  • SSDEEP

    768:VdhO/poiiUcjlJInSCLue9H9Xqk5nWEZ5SbTDa1WI7CPW5I:rw+jjgnNye9H9XqcnW85SbT0WIA

  Score

  10^/10

  xenoratratspywarestealertrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2