Extracted

• • Target

    961bb8d539234e99855580fca5faffae8adef8d736d30deb34c678125098d711

  • Size

    2.4MB

  • MD5

    19f800a3a545e1b561f2252b5c0e0e67

  • SHA1

    67ac88d73c24ab0b7f5224d6544bab466d3cfdbd

  • SHA256

    961bb8d539234e99855580fca5faffae8adef8d736d30deb34c678125098d711

  • SHA512

    fb5c0287288ac310380925a9e71dd95df6b681b8c47e782f9747d20ced82d0501db58c5626df93d8c6601363dc7fa25906128a567a6ef5ef404bce5ca394921b

  • SSDEEP

    49152:lU9LXFXogd7j9ja4byzZwDNvuVxvxNlzQjxkdCv0FYtaPyZ9yLVJoWriNIZF5:lUV5HjOwGxJN+jxkdKbtaPYyLVJoY

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2