Overview

overview

10

Static

static

3

UnamBinder.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    UnamBinder.exe

  • Size

    9.4MB

  • Sample

    240702-wajdvaxhqn

  • MD5

    70565dbd654937df2eaefc7c79941169

  • SHA1

    5cb8daf1185704a9772f07dcec2e499149517715

  • SHA256

    a90ba5a56422c0d2a41f28da056affd69cc8929e14dcdab1583ec96b50b8e28d

  • SHA512

    64b89f77d6528c838c0288c59203455ea3318028816d4426f818c6b8c3258d8e5e13242b175d7b3402547cfd5a0acddb212b9f9b5bbf5d259cd4befc2d078a4c

  • SSDEEP

    196608:g81oBGyk1BK5Gf01Up2GRlRaNqg4eS+wDjxx1ohqsIOGvuQdaQ:g46GykqGf5sGRT2qFP+GDAqkG2i

Score
10/10
xenoratrattrojan

Malware Config

Extracted

Family

xenorat

C2

37.120.141.155

Mutex

SteamUDP_FULL

Attributes
  • delay

    5000

  • install_path

    temp

  • port

    22914

  • startup_name

    SteamUDPUpdater

Targets

    • Target

      UnamBinder.exe

    • Size

      9.4MB

    • MD5

      70565dbd654937df2eaefc7c79941169

    • SHA1

      5cb8daf1185704a9772f07dcec2e499149517715

    • SHA256

      a90ba5a56422c0d2a41f28da056affd69cc8929e14dcdab1583ec96b50b8e28d

    • SHA512

      64b89f77d6528c838c0288c59203455ea3318028816d4426f818c6b8c3258d8e5e13242b175d7b3402547cfd5a0acddb212b9f9b5bbf5d259cd4befc2d078a4c

    • SSDEEP

      196608:g81oBGyk1BK5Gf01Up2GRlRaNqg4eS+wDjxx1ohqsIOGvuQdaQ:g46GykqGf5sGRT2qFP+GDAqkG2i

    Score
    10/10
    xenoratrattrojan

    • XenorRat

      XenorRat is a remote access trojan written in C#.

      trojanratxenorat

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks