Overview

overview

10

Static

static

3

aimware_crack.vxm.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aimware_crack.vxm.exe

  • Size

    1.6MB

  • Sample

    240812-t8fdqstglh

  • MD5

    dc85bae1202fceec41a1af1add6b111c

  • SHA1

    51efca3566ca1650018d2693df6f05ff0f9370b5

  • SHA256

    a38af349ae73b656ded80425ebdedec049d65da5daa7259cb868fcd9ffde9005

  • SHA512

    3626c272a9d8c22f39d7d7d93b0953316272f03908692f83b183e1489c9a3bc487a8d40f3cf667754d685d849745ef49576ba0b59e9e125686a3b379e27a4a35

  • SSDEEP

    49152:puc4UKe2JzShwl+fq+tWWn/yxQSIpYci:pNzK5zSW6qDW/yxQSAi

Score
10/10
xenoratdiscoveryrattrojan

Malware Config

Extracted

Family

xenorat

C2

147.185.221.21

Mutex

nd8912d

Attributes
  • delay

    3000

  • install_path

    appdata

  • port

    6663

  • startup_name

    svchost.exe

Targets

    • Target

      aimware_crack.vxm.exe

    • Size

      1.6MB

    • MD5

      dc85bae1202fceec41a1af1add6b111c

    • SHA1

      51efca3566ca1650018d2693df6f05ff0f9370b5

    • SHA256

      a38af349ae73b656ded80425ebdedec049d65da5daa7259cb868fcd9ffde9005

    • SHA512

      3626c272a9d8c22f39d7d7d93b0953316272f03908692f83b183e1489c9a3bc487a8d40f3cf667754d685d849745ef49576ba0b59e9e125686a3b379e27a4a35

    • SSDEEP

      49152:puc4UKe2JzShwl+fq+tWWn/yxQSIpYci:pNzK5zSW6qDW/yxQSAi

    Score
    10/10
    xenoratdiscoveryrattrojan

    • XenorRat

      XenorRat is a remote access trojan written in C#.

      trojanratxenorat

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks