xenorat | 6a08abcb9640985a9aee4900b924a7b191780dc08feb7df5a4d194ffda6fbd41 | Triage

Sharing

General

Target

6a08abcb9640985a9aee4900b924a7b191780dc08feb7df5a4d194ffda6fbd41
Size

112KB
MD5

624f9be45145b836942f1b5c97a5d11e
SHA1

13771bea85086e948f50e4f15db2d9c08cd21cb8
SHA256

6a08abcb9640985a9aee4900b924a7b191780dc08feb7df5a4d194ffda6fbd41
SHA512

19912a92b52ab5d9475f95d070e77f178f4324d64f6dd8e3f807d5f9ed1a8b19f414dd8a7ce24b2f1070f76eac593cc65e8a77038f21568e8d85725056e70dd8
SSDEEP

768:xdhO/poiiUcjlJInvvH9Xqk5nWEZ5SbTDaJWI7CPW5EHVL:vw+jjgn3H9XqcnW85SbTAWISp

Score

10^/10

xenorat

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

Xeno_rat_nd8912d

Attributes

delay
5000
install_path
nothingset
port
4444
startup_name
nothingset

Signatures

Xenorat family
xenorat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6a08abcb9640985a9aee4900b924a7b191780dc08feb7df5a4d194ffda6fbd41

Files

6a08abcb9640985a9aee4900b924a7b191780dc08feb7df5a4d194ffda6fbd41
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ