Extracted

• • Target

    https://raw.githubusercontent.com/IncsecRishie/wdwddwdw/main/something.exe

  Score

  10^/10

  xenoratpersistencerattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1