Extracted

• • Target

    88696cf17417a2339b63f9452404c839.exe

  • Size

    614KB

  • MD5

    88696cf17417a2339b63f9452404c839

  • SHA1

    2123ca0e3764ba65e421d3b5dd7453da955d36f2

  • SHA256

    a5f629e62e8012c0ead81b462bc05ec9d20395af3121f87961f9d2dfde908895

  • SHA512

    a4236f6d52b985420dc733998842815fd24f12236bdbf3b885ed9a15c0d4815dec439cf919925b4b903ac158aba1ba2a8bf9eff20af7134d2e4edbce226f7931

  • SSDEEP

    12288:WcrNS33L10QdrX2ZVncWqvo2GAhcWMuql8lPtahdkkB183kD:FNA3R5drXwVcWWyLZ8db3kD

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2