Extracted

• • Target

    84aa5512d3260fb2ab5bfb670be32b10N.exe

  • Size

    50KB

  • MD5

    84aa5512d3260fb2ab5bfb670be32b10

  • SHA1

    0edec332527e587ae47481278428e9c451a83de1

  • SHA256

    ea95e26a0cc6fbc78c24a321bd38cbafb90e1b5082ea70c3d6cdd8c421914710

  • SHA512

    59f51abe2eab5753a85063386f0dd14a075d18ca2840419031ca73dc786f51bbe8b56bdfdff5f87366bc0395ba72bb4a6825ad98d5046d773b08d55ae6c5c413

  • SSDEEP

    768:qdhO/poiiUcjlJInvonH9Xqk5nWEZ5SbTDaBWI7CPW5ZZW:Mw+jjgnAnH9XqcnW85SbToWIRZW

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2