Extracted

• • Target

    SaturnTempSpoofer.exe

  • Size

    181KB

  • MD5

    0380311e496051295f02a440d4f34308

  • SHA1

    d2b2d91ced3d0526fcb13f310bb5f7be4844b346

  • SHA256

    ab0f362333e655da8332ba89226f9ac0c90e31aa53e633097cf6f88aead1a389

  • SHA512

    b95a20df94c311deb080d45e1bcd7cd3f79e449041acd52bc67423adb50f49ec9e4728838f96aaec0f67d1fb9cb7403be0e445db06928434f49baac565be600e

  • SSDEEP

    3072:UVqoCl/YgjxEufVU0TbTyDDalQlzw+jqZ91UbTK4I:UsLqdufVUNDaRW491Ub8

  Score

  10^/10

  xenoratdiscoveryevasionpersistencerattrojan

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2