Extracted

• • Target

    con.exe

  • Size

    46KB

  • MD5

    9e9de34664b5fef539593d23c6a4bc5b

  • SHA1

    78f446658ac0fa6d3be493204a2a01321fada36d

  • SHA256

    a11fd0b4c7ac78c9ac8e4e1210ac8a5964703bf9a4e849e58e6b2d217c87f8ed

  • SHA512

    e449331af199801ce8919893c59842d63e3aef69d083500adaa32e56a4fb6f9f6f2523b3e3a9b01b30883d105a27d7c62cd13b2ec4cc6199741ce6c87f91d749

  • SSDEEP

    768:DdhO/poiiUcjlJInNCH9Xqk5nWEZ5SbTDa2uI7CPW5d:Rw+jjgn8H9XqcnW85SbTLuI1

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2