Extracted

• • Target

    GCclientV1.exe

  • Size

    45KB

  • MD5

    6c0987679747dfe56c8a4bc28860cb2f

  • SHA1

    00ff1ad0b4000be73188c8b6a8d91a4a99c48b57

  • SHA256

    6bed3b85a45853d8b4ce39d2db9ffbb2d54f90c15bde96caf9b08245e653fcec

  • SHA512

    4970b77b4f67de3d6731085f762daf10ebe751449671ccb7fea31076bdc941488f79136fbd697fc3e363d7a2b727604eff676012f0c75602e22b5f5411bb50c5

  • SSDEEP

    768:5dhO/poiiUcjlJIns5C2H9Xqk5nWEZ5SbTDa8uI7CPW5d:3w+jjgnsM2H9XqcnW85SbT5uIV

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2