Extracted

• • Target

    202405187a072413981fe91978c58ae13cda3766ngrbotsnatch

  • Size

    5.1MB

  • MD5

    7a072413981fe91978c58ae13cda3766

  • SHA1

    a3860a84d97d1e5a754c61a7e86d2815003ca7b9

  • SHA256

    2b83224eb8a3b749f36c78780d727898233e371572269af2d0853c63d470cfee

  • SHA512

    328eed10f0c4f47fdfbfcad00b66fd972590fabe42569e4d0c7f7d4f3f9dd5923954225503fee442f72a0f10285f293d6119f8bf341736b8fff37f7a29568e0a

  • SSDEEP

    49152:HcIa7C33IJszhP0o/eiY9iCl3miEcUD9HTxTju5EFhoRvE9Zzy:8a33IGNPaiCUu0duEFSRx

  Score

  10^/10

  xenoratevasionexecutionpersistenceprivilege_escalationrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2