Overview

overview

10

Static

static

10

KNRL STARTUP/KNRL.exe

windows7-x64

10

KNRL STARTUP/KNRL.exe

windows10-2004-x64

10

KNRLBOOTSTRAPPER.exe

windows7-x64

10

KNRLBOOTSTRAPPER.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    KNRL EXECUTOR.zip

  • Size

    162KB

  • MD5

    7b4ded80d8a4de2f4fbb5676d2160045

  • SHA1

    2a3c8ecf1777d53f5aa6807c0233a4ad9bdf9abe

  • SHA256

    efa1baf24f60a06fe68e70d3e2fbc7dc9b937917bc24a76bff5bc503c91e959f

  • SHA512

    d8a2242a67b59f652b39e457660a36bc6a6f4804252353684fe037327cddb4b8279efa9c637c84f777647060d871d3b0be96e9764c8ce2b70619767f29bd1630

  • SSDEEP

    3072:uXn5wfW8/VwomdZEPJ8dmRLl/Xn5wfW8/VwomdZEPJ8dmRLlK:AOfrfm/uJFvOfrfm/uJFK

Score
10/10
xenorat

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    5000

  • install_path

    nothingset

  • port

    4444

  • startup_name

    Xeno_manager.exe

Signatures

  • Xenorat family
    xenorat
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • KNRL EXECUTOR.zip
    .zip
  • KNRL STARTUP/KNRL.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • KNRL STARTUP/PLUGINS/PLUGIN.txt
  • KNRLBOOTSTRAPPER.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections