General

  • Target

    asa.exe

  • Size

    45KB

  • Sample

    240810-a691sa1hpd

  • MD5

    2c0fc0bb0f24233fecf2430fe5851ded

  • SHA1

    1d3503d6e71eba788a02a1288ba85422e9349fea

  • SHA256

    e9c1454178cf25794257a759159d732889cd21029c341277cbd2744389eb2856

  • SHA512

    35f5bb99063bfd4453b2bafad9802d9b1858170a9ec207782cd1ea44ed31f3fc822b260cdee25c4c1b5ca98bc7b135707e556c2476e79d82f0cd95a4b82a8d9f

  • SSDEEP

    768:hdhO/poiiUcjlJInLtUH9Xqk5nWEZ5SbTDazWI7CPW52:fw+jjgnhUH9XqcnW85SbTiWI+

Malware Config

Extracted

Family

xenorat

C2

76.109.192.116

Mutex

Nitro-Gen

Attributes
  • delay

    1000

  • install_path

    appdata

  • port

    7777

  • startup_name

    Nitro

Targets

    • Target

      asa.exe

    • Size

      45KB

    • MD5

      2c0fc0bb0f24233fecf2430fe5851ded

    • SHA1

      1d3503d6e71eba788a02a1288ba85422e9349fea

    • SHA256

      e9c1454178cf25794257a759159d732889cd21029c341277cbd2744389eb2856

    • SHA512

      35f5bb99063bfd4453b2bafad9802d9b1858170a9ec207782cd1ea44ed31f3fc822b260cdee25c4c1b5ca98bc7b135707e556c2476e79d82f0cd95a4b82a8d9f

    • SSDEEP

      768:hdhO/poiiUcjlJInLtUH9Xqk5nWEZ5SbTDazWI7CPW52:fw+jjgnhUH9XqcnW85SbTiWI+

    • XenorRat

      XenorRat is a remote access trojan written in C#.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks