Extracted

• • Target

    9fec52616fa7fde2303c0b086aca7af1dd8d51071b6abcfc6a0a878dbd8adc57

  • Size

    249KB

  • MD5

    8e44f5acbb19af4f66ec3561c83323a3

  • SHA1

    52a6d61bcaed65fa4a7814de6828b58ba86811fe

  • SHA256

    9fec52616fa7fde2303c0b086aca7af1dd8d51071b6abcfc6a0a878dbd8adc57

  • SHA512

    b5c8ff9c5c8bdf58ecc4f91026e035744f58010e7d68816d01d7757827ec009d85eb64046871660c49fa71a1cea1d0df4c11be81817cfc2f775b482e48f1cd5a

  • SSDEEP

    6144:iZ5sGZEE8GPBmJOR4fG7/LmGvdXF6BfOJbsoeqsOI:iZ5s2AGJL4OjaGlF6BfOJbsoeqsz

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2