Overview

overview

10

Static

static

10

Spoofer.exe

windows7-x64

10

Spoofer.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Spoofer.exe

  • Size

    45KB

  • Sample

    240904-3cft3azbmb

  • MD5

    9cd971f0e65470ce291b479f21347ec0

  • SHA1

    1ddb30a4c205cd84854798ca74ca09ac5d745233

  • SHA256

    8a498dbf2e73ee2a5920ff22582eb0bc07721ea62c1d70dcfbaf7e41979a1da4

  • SHA512

    b28792401069c0ae200fc41f2e86caacc4f604ba921482ad8a230ad12fcba9126d9b6b019e196869f5b935f0966defd2438aca5773becc7c7b4610c1c8fbe2a2

  • SSDEEP

    768:udhO/poiiUcjlJIns3EH9Xqk5nWEZ5SbTDaauI7CPW5e:4w+jjgn+EH9XqcnW85SbT/uI2

Score
10/10
xenoratdiscoveryrattrojan

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

Celex

Attributes
  • delay

    5000

  • install_path

    appdata

  • port

    8080

  • startup_name

    Steam_service

Targets

    • Target

      Spoofer.exe

    • Size

      45KB

    • MD5

      9cd971f0e65470ce291b479f21347ec0

    • SHA1

      1ddb30a4c205cd84854798ca74ca09ac5d745233

    • SHA256

      8a498dbf2e73ee2a5920ff22582eb0bc07721ea62c1d70dcfbaf7e41979a1da4

    • SHA512

      b28792401069c0ae200fc41f2e86caacc4f604ba921482ad8a230ad12fcba9126d9b6b019e196869f5b935f0966defd2438aca5773becc7c7b4610c1c8fbe2a2

    • SSDEEP

      768:udhO/poiiUcjlJIns3EH9Xqk5nWEZ5SbTDaauI7CPW5e:4w+jjgn+EH9XqcnW85SbT/uI2

    Score
    10/10
    xenoratdiscoveryrattrojan

    • XenorRat

      XenorRat is a remote access trojan written in C#.

      trojanratxenorat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks