xenorat | c5f773352e72b43cd0a77de21f84d757724c38614080803cfb573f7d61295afa | Triage

Sharing

General

Target

c5f773352e72b43cd0a77de21f84d757724c38614080803cfb573f7d61295afa
Size

45KB
Sample

240712-qkekraxdlf
MD5

652e746bd24f89a2d08fd6cdddff1e66
SHA1

9762ff799ada4f1a4c2da27d2e403db63dd86ba3
SHA256

c5f773352e72b43cd0a77de21f84d757724c38614080803cfb573f7d61295afa
SHA512

c08a43333c718e02664e3e46ca9d792138c5b6a9ed549ecf1b8779157c480c178b0b129c8f9d7526eaaf5ba06678547efe5a19a0052ea57ed67fc39337afe79a
SSDEEP

768:iWdhO/poiiUcjlJInEeH9Xqk5nWEZ5SbTDaNWI7CPW5I:pw+jjgnDH9XqcnW85SbTsWIA

Score

10^/10

xenorat rat trojan

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

opengl

Attributes

delay
5000
install_path
nothingset
port
4444
startup_name
nothingset

Targets

- Target
  
  c5f773352e72b43cd0a77de21f84d757724c38614080803cfb573f7d61295afa
- Size
  
  45KB
- MD5
  
  652e746bd24f89a2d08fd6cdddff1e66
- SHA1
  
  9762ff799ada4f1a4c2da27d2e403db63dd86ba3
- SHA256
  
  c5f773352e72b43cd0a77de21f84d757724c38614080803cfb573f7d61295afa
- SHA512
  
  c08a43333c718e02664e3e46ca9d792138c5b6a9ed549ecf1b8779157c480c178b0b129c8f9d7526eaaf5ba06678547efe5a19a0052ea57ed67fc39337afe79a
- SSDEEP
  
  768:iWdhO/poiiUcjlJInEeH9Xqk5nWEZ5SbTDaNWI7CPW5I:pw+jjgnDH9XqcnW85SbTsWIA
Score

10^/10

xenorat rat trojan
- XenorRat
  XenorRat is a remote access trojan written in C#.
  trojan rat xenorat
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xenoratrattrojan

behavioral2

xenoratrattrojan