xenorat | xero[.]rar

resource
unpack001/xero/xero.exe

xero.rar

SHA256 41218c54d65efa9ea37bfcee51e294871687cddcb014e1b796c31a022c4df164
MD5 9f2296874fda840717a03bc4f084e01c
SHA1 25d6f7f448ac45bcb6111c052a4a78d52584aa92
SHA512 7f78babd620de9ee0ccb0ae7d65f2f26ddd065145439e785d1ee87a478cfa08f5ce848f1b047f1a8bafdd6ee36375c2a634a7082919c6bac3ca8615d82dff2a7
SSDEEP 98304:cXL+2tjqXfZivDRU2yvKsJKKro8nKv15sf62NO1dqnTWLHAOd2IyPF3kZTEy:cRYXfcDKlvtKsdntf7KdqSLHtd2IakZL
MD5 SHA1 SHA512 SSDEEP

xero/_license.dat

SHA256 e41a2a90a760e08baada958e9229040c06cb1f4eded51c0fd2c67f2cb2b921bd
MD5 0d0a61eb583c229405b1b0fd5e132ee8
SHA1 f79c7871c6ed28bf7e9065f469796c9c8b33aec7
SHA512 6d2708c78bcdaccbf63d57cc62e8ee221d5d7713d30ddc71d54d4ee7ce35a944e68f53dedc5007d67b9f0d76372945714f8539fcc0b48672601aa51e608fe24b
MD5 SHA1 SHA512

xero/config/TEST.mcf

SHA256 8aa6bb75ec3a53acfb387551db8322a8d0f8a676f759fd5149ce0a57b9ba90dd
MD5 6f49fb29ecc1d7c4a127e23c002059d6
SHA1 4422947f27a7f32fee5f5d4fbaeb0bc34013043b
SHA512 cbe27e02f18499f8bd20b404583724199624f939c588d01db95e627b61d1df92dd10be5133bfa7e233d84b8e031501ce96fb7a83d0e67695e6b2e01025f376ea
MD5 SHA1 SHA512

xero/config/TEST2.mcf

SHA256 0ae6a0cb4abca88de27eb62e7f640d96c7227bb0af31b93f158427619815033a
MD5 61e905380b191ce1419aa186c1a1c01d
SHA1 1d4d87c83cff88371575fddcf3e72ad08f4dbbf7
SHA512 421b8af418ad794e9c2b6d1412da6cca304468ee1635a169f3ff58c04edc0218bb1d2e8453934819ae6f91f0f6e65d9300b6cbbcf3c4dd6081039acb82284c2b
MD5 SHA1 SHA512

xero/imgui.ini

SHA256 11235dd35562d43f528bb6f725ec6f80816ba2831191117b911b7ed2b9618485
MD5 ac73443d00403cffa79449583828cf28
SHA1 1420d6f558f946a4838a29496178af36fdeea34d
SHA512 799a165059ac285ae4b42e445c75022dd2b707881620b98625fd5f42c7745d0afe94bac6bc471d5abf09ac546878a13e97865f05d980f3957c1cbee845fe6d43
MD5 SHA1 SHA512

xero/version.dat

SHA256 715812b3486aef90634a93be6afc9af2e0ef6b9937d7db94e50f72a70c060929
MD5 bb30c1b92fa89ec830e296d19f4cbc9a
SHA1 bd27068ee8590e1c353dafdeb951311578400235
SHA512 989aa80bbe63106191bb2a351e62ec8465311e47b2bad23854d9b4c34ac87f48566cd2a88276cca3a89e42706446828698b5a24859f77ae54715bccf0683ed4e
SSDEEP 196608:l7VEwirf7dmYBpBZTPLVPLDtttNgqBTBf5QwtpD998AmZ1PFWX4buuI7finzj:l7VEwirf7kYBpBZPJLgqBTBz99FmX3b5
MD5 SHA1 SHA512 SSDEEP

xero/xero.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a250d17fc5aedefe2b11a61a8702839cf47317dc36b88e5abeb789a019787c07
MD5 3b55e1134c4d41bd31da43caa2e281e3
SHA1 626b6f42961606a84f55529388ba5a761f773ee0
SHA512 efb34525c6d2216569b981fdca53e0ca5123195d5559eedffe90aec98fdea1c49734cfeb1bb4fc38b1147059be057b64180c8d71867a93739cb27bee03af722e
SSDEEP 768:tdhO/poiiUcjlJInDQuH9Xqk5nWEZ5SbTDaWWI7CPW57:jw+jjgnRH9XqcnW85SbTvWIj
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

51966

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

xero.rar

xero/_license.dat

xero/config/TEST.mcf

xero/config/TEST2.mcf

xero/imgui.ini

xero/version.dat

xero/xero.exe

mscoree

dotnet

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

xero.rar

xero/_license.dat

xero/config/TEST.mcf

xero/config/TEST2.mcf

xero/imgui.ini

xero/version.dat

xero/xero.exe

mscoree

dotnet