Extracted

• • Target

    aimware_external.exe

  • Size

    1.1MB

  • MD5

    f3726ec3f03283f95e814d084a2769be

  • SHA1

    44afeb86f4d8bfdd8cf49843fc79dc5c5f3d5cb8

  • SHA256

    20f245865bcfc518bf44fa8b1bbfa3c91724ed003d65c5002f9823deddad6d6c

  • SHA512

    93cb5e28494193f0bec93877bfbefda33b71a61fb3d113e20e3f3bf905bc7b530e057218d6ba52c03e13054471c9e8de00e24ecea4747550e209993562d9b29c

  • SSDEEP

    24576:Rc7LqjkLHKx9JYjdK/UmJcgzILePcmVsT+2aicZRDTM1/DEf:RcCkHKxQm9fcmV4+jNZRDsLg

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1