Overview

overview

10

Static

static

10

xaaworks.exe

windows7-x64

10

xaaworks.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    xaaworks.exe

  • Size

    45KB

  • MD5

    cf4cec2d9e27437e8f72ba0d49ada753

  • SHA1

    4f13e9ac937398f255a3d105d98430af5b07aba2

  • SHA256

    aedeabc66b1a4c080060d2c454306d06763818fcdd965004031f4a59a382dee0

  • SHA512

    ac1030e00033bde9f3511e38b5dd4d5e9b09ac27ded45ae0a53fb45fee6b6b8a6e8cb729a9579f206a040b2dccdd3637dea5e16c3ff10802e1eac987fc38df9f

  • SSDEEP

    768:5dhO/poiiUcjlJInQtUH9Xqk5nWEZ5SbTDayWI7CPW55:3w+jjgn+UH9XqcnW85SbTrWIB

Score
10/10
xenorat

Malware Config

Extracted

Family

xenorat

C2

10.0.0.232

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    5000

  • install_path

    appdata

  • port

    4444

  • startup_name

    Xm

Signatures

  • Xenorat family
    xenorat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • xaaworks.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections