Extracted

• • Target

    0ecb6966a5dc7138bd15bde42ed8afb0N.exe

  • Size

    240KB

  • MD5

    0ecb6966a5dc7138bd15bde42ed8afb0

  • SHA1

    a9fb9c5d41775f19bb298d9cc07fbc67ec83c4ca

  • SHA256

    8134112787a6bc8495d55a81f935b8ac3292b221f61aad14ee94c1f86d2572c9

  • SHA512

    bd5e9c0a9e675ce4881db3ec6ecf17f323a1d72eb31c7d84532086b95965fd8aa1a87520eee284379ceb767d29803ed3e94b7e76d3da011a936cdb264b6140db

  • SSDEEP

    3072:HLuAuVtuicIuUEokbfcROA3FdeIAwAd+ShRYXPDedhnwULCi2yptKId4KhMdaE7y:HLuAcpcI1Vdzl3UCyyIdMdaE7RK6I

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2