xenorat | 56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e | Triage

Sharing

General

Target

56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e
Size

45KB
MD5

c256e2fb6c6111d1bbaa46bd2f081be2
SHA1

fdbc207fd0dc681e13e68effd8fa9a372bea9052
SHA256

56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e
SHA512

0ccde1e1c13c764d184b097218282c4b9dfde70c1bb2b1be737f01b46e1f4a824850531f8ab2e9ba99837c9b552f4fbfc53cdda03c09f82dc3c19ee3e321eca9
SSDEEP

768:9dhO/poiiUcjlJInlaH9Xqk5nWEZ5SbTDabuI7CPW59:zw+jjgnsH9XqcnW85SbTmuI1

Score

10^/10

xenorat

Malware Config

Extracted

Family

xenorat

C2

192.168.100.200

Mutex

Wiiindowss Deffender

Attributes

delay
5000
install_path
appdata
port
8848
startup_name
Windows Defender

Signatures

Xenorat family
xenorat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e

Files

56b6c2ebd23727dd8d58648db3114ef88dd1561dd8e92f082b9ad3874cc1d93e
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ