Extracted

• • Target

    56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e

  • Size

    45KB

  • MD5

    c256e2fb6c6111d1bbaa46bd2f081be2

  • SHA1

    fdbc207fd0dc681e13e68effd8fa9a372bea9052

  • SHA256

    56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e

  • SHA512

    0ccde1e1c13c764d184b097218282c4b9dfde70c1bb2b1be737f01b46e1f4a824850531f8ab2e9ba99837c9b552f4fbfc53cdda03c09f82dc3c19ee3e321eca9

  • SSDEEP

    768:9dhO/poiiUcjlJInlaH9Xqk5nWEZ5SbTDabuI7CPW59:zw+jjgnsH9XqcnW85SbTmuI1

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2