Extracted

• • Target

    f81185426901a3519e4d8d030d677ecf8a50d873fecfdd3980ef3ccfac785707.exe

  • Size

    367KB

  • MD5

    3b28af41d6afa46a8e9b5707e3bfb8f7

  • SHA1

    421755f9c95e2c7140241859983ad8665cf67b41

  • SHA256

    f81185426901a3519e4d8d030d677ecf8a50d873fecfdd3980ef3ccfac785707

  • SHA512

    ddd508da739baacbd05c63b86dc0df4b6b74b416a332e967e8cddf16f1fec5b28ee2cf2a0c82b4ddc7e3fb11040bc15d13330cf73cfce9020cba4d605ceb1729

  • SSDEEP

    6144:H0ths4dDpxQCc6nxbx5S9l2VFqNK8xpDSznNkBJn64nJl0lvzewww0JwwgSnvYq:HKs45p2sxKP2VSKIoznSv64nJl0lvz3t

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2