Extracted

• • Target

    07082024_0919_dthsgs.exe

  • Size

    250KB

  • MD5

    8def0f85d1f18a9a6b700224c7bd9d9c

  • SHA1

    1ac4779022750a9069e5f613200bcce258803b6d

  • SHA256

    c7e7be05ba49a626dab92a2a2d52dbecfd77cd307b91c231a1e01793eeed86eb

  • SHA512

    3614926f9af7332f35a725daf47e0042be035b3efcc668c1b36ee2a7a5d5a6bf3ea11301ce58ee5169d0e6bc74d8bd7ad910a0e44e2951fb40f25210eb00c170

  • SSDEEP

    6144:Cmj4xlRcbUEZA9qYK51W31+6jWB+U7C2I:z4V2A9qYK51WpjWB+U7CL

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2