General
-
Target
gdfgdfgfdg.exe
-
Size
45KB
-
MD5
b1ff6fc37c6f30705b60421bad837ba1
-
SHA1
86c14aa784f97ac9018bd33d2b2cda2606dc0679
-
SHA256
009c7b94b0d9541477c43105707754fa3ad4962dc561533a4a0b86689f2518db
-
SHA512
5bb2f33b6d7663a88290e0bffc81470614455da4ebf5ea8aae4e8b38b41d702dce1ca47616808f2cfd48c6061b935ec1379281bb43e56f4e1c153e1abb67ba09
-
SSDEEP
768:1dhO/poiiUcjlJInUonH9Xqk5nWEZ5SbTDawWI7CPW56:Lw+jjgn/nH9XqcnW85SbTJWIS
Malware Config
Extracted
xenorat
related-directed.gl.at.ply.gg
TestingRat
-
install_path
appdata
-
port
3403
-
startup_name
nothingset
Signatures
-
Xenorat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource gdfgdfgfdg.exe
Files
-
gdfgdfgfdg.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ