Extracted

• • Target

    6e1d75869d89661a72eedce7e8b0613540cd939bbfa7c1cbf032403b5a8d96f3

  • Size

    249KB

  • MD5

    d9dec4584b14bc1d0c5f51522743a385

  • SHA1

    3e1269800b8cfb93f802307354eb8227f6503f05

  • SHA256

    6e1d75869d89661a72eedce7e8b0613540cd939bbfa7c1cbf032403b5a8d96f3

  • SHA512

    5976deb2bb2084cd00d9888602e75b1966a9b0f4f8b1e23814f7f988b050523538c33e39d2874bf0e586b5bedae6257e05732434179c7f88f022f2eeb98b3dbd

  • SSDEEP

    6144:18arJr5++gsCwCZ41JD7Ae31rwMwAZtUSiHrmM8FDy47j+wf6y5Mlg5XI:XNr1Kv41Joi2k/U4Dy47j+wf6y5Mlg54

  Score

  10^/10

  xenoratcredential_accessdiscoveryratspywarestealertrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2