Extracted

• • Target

    5bf990aad6834600b8a95d150ea0775d7c826418e8f93f68e948feabd256c363

  • Size

    45KB

  • MD5

    e3d41f5c084aa851347971f18b9bb493

  • SHA1

    4a840d0be1805bcb519952d7c8a692a635f57b2e

  • SHA256

    5bf990aad6834600b8a95d150ea0775d7c826418e8f93f68e948feabd256c363

  • SHA512

    49d66e4d0bd03385ff4c66f0c1a853b254e69fea592a9c7f603f09edf16261062850c9be4865b5b7a84dd7dd10452e9ff524c4bc52037cfce4cab004fd556a5a

  • SSDEEP

    768:adhO/poiiUcjlJInolH9Xqk5nWEZ5SbTDa/WI7CPW5G:8w+jjgnYH9XqcnW85SbT2WIe

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2