Extracted

• • Target

    xaaworks.exe

  • Size

    45KB

  • MD5

    cf4cec2d9e27437e8f72ba0d49ada753

  • SHA1

    4f13e9ac937398f255a3d105d98430af5b07aba2

  • SHA256

    aedeabc66b1a4c080060d2c454306d06763818fcdd965004031f4a59a382dee0

  • SHA512

    ac1030e00033bde9f3511e38b5dd4d5e9b09ac27ded45ae0a53fb45fee6b6b8a6e8cb729a9579f206a040b2dccdd3637dea5e16c3ff10802e1eac987fc38df9f

  • SSDEEP

    768:5dhO/poiiUcjlJInQtUH9Xqk5nWEZ5SbTDayWI7CPW55:3w+jjgn+UH9XqcnW85SbTrWIB

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2