xenorat | f000c7fb9844e917eb223f1a1a8035fc2f95df89625441e18e9666f405d72b20 | Triage

Sharing

General

Target

f000c7fb9844e917eb223f1a1a8035fc2f95df89625441e18e9666f405d72b20
Size

45KB
MD5

caed2f9a1430222267c829424048a584
SHA1

22efb3b0d0bef8ded5920b053b3bb318eb1c2c3f
SHA256

f000c7fb9844e917eb223f1a1a8035fc2f95df89625441e18e9666f405d72b20
SHA512

983a371077305af97c46f30da531e4fe88181451496956d6b6871896e858568249bad33a69905a40c7619056dd6a4d2820c1bc3f88379dfee80577b2274231ba
SSDEEP

768:BdhO/poiiUcjlJInxQH9Xqk5nWEZ5SbTDan0WI7CPW5h:/w+jjgnqH9XqcnW85SbTG0WIJ

Score

10^/10

xenorat

Malware Config

Extracted

Family

xenorat

C2

syfhnuc714-20814.portmap.host

Mutex

Celex_Cracked

Attributes

delay
5000
install_path
temp
port
8080
startup_name
Steam_Service

Signatures

Xenorat family
xenorat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f000c7fb9844e917eb223f1a1a8035fc2f95df89625441e18e9666f405d72b20

Files

f000c7fb9844e917eb223f1a1a8035fc2f95df89625441e18e9666f405d72b20
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ