Extracted

• • Target

    54eafd9bd8105444ccd57e92dc3bee43166532da0a71e26686fe9913956f6243.exe

  • Size

    253KB

  • MD5

    e74db56e352d5015304af19ec21ffeb5

  • SHA1

    cf026e98f937ea8989a789fa8e43895f3f642431

  • SHA256

    54eafd9bd8105444ccd57e92dc3bee43166532da0a71e26686fe9913956f6243

  • SHA512

    32854f3b960a17c9051714d4b456517607f21e57547c6711b4ae2020c54462ca554edc01d789052a66e082637ed6cf9854e624b6d938c6c852a282de13299dc2

  • SSDEEP

    6144:fK0vMcNP/YJ4/OmWMDJBP1FOHu10jc9ppUATB4KQK0f6nYSr8Kg0I:fK0vDE4dDJN6Hu10jcraOB4KQK0f6nYX

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2