Extracted

Extracted

• • Target

    GOINDIGO_PN#_Desc_&_Qty Details.vbs

  • Size

    6.6MB

  • MD5

    6776a1e5031d3e57bff6359bc884c1f3

  • SHA1

    bb9883c15f718846f1e23744f09044fc6185f25f

  • SHA256

    56c0fcdebcda39f9a98c7b4471aeee2e8e7389bf2e5874fa945fe3f61c4ac654

  • SHA512

    7b0c36ffa6ffdf300cfe50539f096cbc3a0181b8a1632012c88bea3270cf239757c45b4f26a3aaf723b9bce29fdb22194ddd6351b669d2257fe34523fe1c1f81

  • SSDEEP

    1536:7ssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssV:SI

  Score

  10^/10

  executionxenoratpersistencerattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2