Extracted

• • Target

    d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267.exe

  • Size

    235KB

  • MD5

    0dba4bed5bf4e4c327b712f723e714c5

  • SHA1

    b8609db0404983d9a7f2bc4639d93a539bb883a6

  • SHA256

    d484104256e41a509ff52bb9a5bbd7bd63aaf18e0b32b68fe3c4bfa6b81aa267

  • SHA512

    3e2d21c7f0f4a97cc491d70bef203e75c91d716706256938d6cb0171cbd8499e902b9d51be4a0afc47c602d5aebf5db22802c38aae29d0ebcd9fb29611824653

  • SSDEEP

    6144:BhTnFgUgcego6uIXCHq2MYOITuVYmE9oO8N21Tx6I:/byUTelnK2fZSVYmE9oO8N21TxP

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2