xenorat | aedeabc66b1a4c080060d2c454306d06763818fcdd965004031f4a59a382dee0 | Triage

Sharing

General

Target

aedeabc66b1a4c080060d2c454306d06763818fcdd965004031f4a59a382dee0
Size

45KB
MD5

cf4cec2d9e27437e8f72ba0d49ada753
SHA1

4f13e9ac937398f255a3d105d98430af5b07aba2
SHA256

aedeabc66b1a4c080060d2c454306d06763818fcdd965004031f4a59a382dee0
SHA512

ac1030e00033bde9f3511e38b5dd4d5e9b09ac27ded45ae0a53fb45fee6b6b8a6e8cb729a9579f206a040b2dccdd3637dea5e16c3ff10802e1eac987fc38df9f
SSDEEP

768:5dhO/poiiUcjlJInQtUH9Xqk5nWEZ5SbTDayWI7CPW55:3w+jjgn+UH9XqcnW85SbTrWIB

Score

10^/10

xenorat

Malware Config

Extracted

Family

xenorat

C2

10.0.0.232

Mutex

Xeno_rat_nd8912d

Attributes

delay
5000
install_path
appdata
port
4444
startup_name
Xm

Signatures

Xenorat family
xenorat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aedeabc66b1a4c080060d2c454306d06763818fcdd965004031f4a59a382dee0

Files

aedeabc66b1a4c080060d2c454306d06763818fcdd965004031f4a59a382dee0
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ