xenorat | 16abb3aaa16ae16e61372a09afa047d0[.]bin | Triage

Sharing

General

Target

16abb3aaa16ae16e61372a09afa047d0.bin
Size

45KB
MD5

16abb3aaa16ae16e61372a09afa047d0
SHA1

3879b4adaf663ea0cb9e0b188f10a99cb1ef71c6
SHA256

f3444a3a8709d89e5297bead9391bea56c2346f0ea528140319f63eacad04c1b
SHA512

0473b8db9ae508776178e3d797cc0aeb5b32cd4f6cc5c6a817bb8f8e0beda31276d95c9de52dae6a77b073057a796c02af2e71bcc57fb9a788f7064c4a6bf1bf
SSDEEP

768:qWtvB1HEfka3+ZJhH3H8QK/Cw3BVhjFD+1nFZ5SbsDThVbox:zXHEaZv3H8gw37K5SbsxO

Score

10^/10

xenorat

Malware Config

Extracted

Family

xenorat

C2

localhost

Mutex

testing 123123

Attributes

delay
1000
install_path
nothingset
port
1234
startup_name
nothingset

Signatures

Xenorat family
xenorat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16abb3aaa16ae16e61372a09afa047d0.bin

Files

16abb3aaa16ae16e61372a09afa047d0.bin
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\alina\OneDrive\Desktop\xeno-modified\xeno-rat-main\xeno rat client\obj\Release\xet.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ