Extracted

• • Target

    Testing.exe

  • Size

    51KB

  • MD5

    9a1824ec694541ef4db6417d38529d5f

  • SHA1

    f57f931fd8868997311faffe4fedb380ae743482

  • SHA256

    17253d61990c1669538399938dcaf6ac523b22cbf85659aed90d6b2e4e3babac

  • SHA512

    edc873d4abd82eb60836d5daad421d730760ee2822e673f1b8a66102a3bc6553956340c025126d34a09a68dc411d1f2a6230ccd2cc82c5561a33a363641f3f8a

  • SSDEEP

    768:yivdjHrddilbVauou79Eo7cqtPBy6HDBSkGu2yPo+LGZYebFDauZ6RNSgNOv:LpHmVauo3xAycDj6CSYebFbAf4v

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2