Extracted

Extracted

• • Target

    job_offer.js

  • Size

    7KB

  • MD5

    99d7d5e0a68fab595c03ba3e5cd12f4c

  • SHA1

    2c6100789c8906e9b308f80c9f4e3839c8aea41f

  • SHA256

    09be56cdd4003075a5a95a741f019105b23dbc140c5e8a034b0795c0a6ef87b9

  • SHA512

    788f5d86d96fc931ff5749dd0e62b874725c47a2ee3712ecf76a9b4867747a337e7dcd5e122d739785056c642d7521296f5c756691dddacc9c8ec4056b630b20

  • SSDEEP

    192:n5o3kqWRrmBE1KE5PqecWjEBiARGBRjdJU+udDqpkE+Rv:n5+zcr2YyTiiG3e02EEv

  Score

  10^/10

  executionxenoratdefense_evasionpersistencerattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2