Extracted

• • Target

    a2944e9f2cc19557586d8b3971418c10N.exe

  • Size

    444KB

  • MD5

    a2944e9f2cc19557586d8b3971418c10

  • SHA1

    15184f8309927af19079c2cd91afd2df2188d750

  • SHA256

    2c85025f7dfc82cfc31b57213ee4f3c54e66e9806801ce11d070ab64f269778f

  • SHA512

    393e9e74344ca43485bef6d9562c7a641549bafc3a48f646d4e9c0e85f7ed03808f1469a376d919b79e7722ebd6322db0de99732e4486dab0906a7232b5f2b79

  • SSDEEP

    12288:vEjB1lxxsFutgrCAPAMJPEcXKHffwWdbNnOL:KB1lxaFut6

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2