Extracted

• • Target

    loader_fixed.exe

  • Size

    7.0MB

  • MD5

    f65f70a4714cc9fe3e8d3f422059d01a

  • SHA1

    6c499688317d35aabd75e7437934764127a49fcd

  • SHA256

    824beea90d19363d695abcb8f8a89bfcd6a07c49e9d477de5db9090c1b368eba

  • SHA512

    0bbe3f63b494707b6feca848fb0eed9c1d33275efa7d236ed9086e837f475ae5f90bcc6919f5484ab1b6eb4388a6958362cee1b14f44ee75040968572ddb5677

  • SSDEEP

    196608:g5ieOqO57FgYAXfylY2Szpm+Ceww+OUQaU+E3wIHzA:ChM7FgYz6nzpZCnaUQhPP

  Score

  10^/10

  xenoratexecutionpersistenceprivilege_escalationratspywarestealertrojanupx

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1