xenorat | b67d8fc52334fb2309368bf2a738520f1b42436951b211b7896f612b86350c10

General

Target

DownlaoderMenu.exe
Size

4.5MB
Sample

240704-vnqveasckf
MD5

ec79983fdb605310fac832ba5809e2d6
SHA1

ca83d6453563e02decf614d0ce331de493267d2f
SHA256

b67d8fc52334fb2309368bf2a738520f1b42436951b211b7896f612b86350c10
SHA512

234bb8696c8a6929784165366dc4317d5826738711a7661bf26e4ffab8e958db23d0f2a11542b3f0b5c4c71d62d3e4bc7a730d94d917a21d132d40e2a67ed460
SSDEEP

98304:ePj50PrsilC2IbhblAh5+dWspirADIsYAVjw1gI:i5gahZWs80sfsw1R

Score

10^/10

Malware Config

Extracted

Family

xenorat

C2

hax.onthewifi.com

Mutex

hAxxx

Attributes

delay
5000
install_path
appdata
port
1960
startup_name
Windows

Targets

- Target
  
  DownlaoderMenu.exe
- Size
  
  4.5MB
- MD5
  
  ec79983fdb605310fac832ba5809e2d6
- SHA1
  
  ca83d6453563e02decf614d0ce331de493267d2f
- SHA256
  
  b67d8fc52334fb2309368bf2a738520f1b42436951b211b7896f612b86350c10
- SHA512
  
  234bb8696c8a6929784165366dc4317d5826738711a7661bf26e4ffab8e958db23d0f2a11542b3f0b5c4c71d62d3e4bc7a730d94d917a21d132d40e2a67ed460
- SSDEEP
  
  98304:ePj50PrsilC2IbhblAh5+dWspirADIsYAVjw1gI:i5gahZWs80sfsw1R
Score

10^/10

xenorat execution rat trojan xmrig evasion miner persistence upx
- XenorRat
  XenorRat is a remote access trojan written in C#.
  trojan rat xenorat
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Stops running service(s)
  evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2