xenorat | a64fb3bf19974ad4369f1cbf8ab7cd5cf598462fb623788f9fd51b86b8361839 | Triage

Sharing

General

Target

imageloggerV2.exe
Size

45KB
Sample

240823-kqgz6svbke
MD5

7b4b9400a241fff39ed69caf21a2bfff
SHA1

418c0cce490a23fb0845bd1126cd40d573592ce0
SHA256

a64fb3bf19974ad4369f1cbf8ab7cd5cf598462fb623788f9fd51b86b8361839
SHA512

dda3bdb11484b0f9ce83f39c7d9356fce18225775678a78d1454a1c943255b5f86a3f6deab19f575cf9596444031d97d13b62ecaa46c5c52f5c45df45b6020d0
SSDEEP

768:pdhO/poiiUcjlJInWC2H9Xqk5nWEZ5SbTDanuI7CPW5R:nw+jjgnX2H9XqcnW85SbTKuIJ

Score

10^/10

xenorat discovery rat trojan

Malware Config

Extracted

Family

xenorat

C2

192.168.1.164

Mutex

Xeno_rat_nd8912d

Attributes

delay
5000
install_path
nothingset
port
4444
startup_name
java updater

Targets

- Target
  
  imageloggerV2.exe
- Size
  
  45KB
- MD5
  
  7b4b9400a241fff39ed69caf21a2bfff
- SHA1
  
  418c0cce490a23fb0845bd1126cd40d573592ce0
- SHA256
  
  a64fb3bf19974ad4369f1cbf8ab7cd5cf598462fb623788f9fd51b86b8361839
- SHA512
  
  dda3bdb11484b0f9ce83f39c7d9356fce18225775678a78d1454a1c943255b5f86a3f6deab19f575cf9596444031d97d13b62ecaa46c5c52f5c45df45b6020d0
- SSDEEP
  
  768:pdhO/poiiUcjlJInWC2H9Xqk5nWEZ5SbTDanuI7CPW5R:nw+jjgnX2H9XqcnW85SbTKuIJ
Score

10^/10

xenorat discovery rat trojan
- XenorRat
  XenorRat is a remote access trojan written in C#.
  trojan rat xenorat
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xenoratdiscoveryrattrojan

behavioral2

xenoratdiscoveryrattrojan