XenoRAT | Triage

Sharing

General

Target

XenoRAT
Size

150KB
MD5

fcc55ef512ccf37a07ec703b59cc7aad
SHA1

9abef70ff67a2a7032ac1da4cd65424e7b2130b7
SHA256

38b26e2364bc081a90145838451341f14bda3cbd15bba54bf0114cab5d2f8667
SHA512

e26567479340c42126937edba18399af1d070b89c95fb8871dcbf3afb524bc89e289d361f4aa038f655e77b28e095ae3e487d8938248ea3d32677168acd17517
SSDEEP

3072:1QeAu96QNvQRARkML2zzFT1xfeRfAqq9a7JcKYfb5q9ZX4o3+mI:v9zvQvMLqFT1JZ9a7NYfbkT93fI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XenoRAT

Files

XenoRAT
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\PROG-MAX\Desktop\PROGMAX\Prog\Traai\AdelTutorials - Crypter\server1\server1\obj\Debug\Display1.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ