Extracted

• • Target

    9319a7b02879066d144b9f84f5b9e4c0N.exe

  • Size

    45KB

  • MD5

    9319a7b02879066d144b9f84f5b9e4c0

  • SHA1

    0634823bf3a1eecb8089634963617e7e484ec45f

  • SHA256

    a9dc5a36a49131fc5c0e0f64eda0f9c00266cf2359aa5689b5dfc7bb74579c69

  • SHA512

    0dad848ba0dc0daf1af8830ad7d54e121c71cf133a83195293ef51a6f02bab2e6fbe27e9b215136f8ceff909c7f54a31d4710bc7d60b4b5b543b67fbdef90bb5

  • SSDEEP

    768:xdhO/poiiUcjlJInJtUH9Xqk5nWEZ5SbTDaHKWI7CPW5g:vw+jjgn/UH9XqcnW85SbTDWIo

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2