Extracted

• • Target

    Bakiye Odemesi.exe

  • Size

    311KB

  • MD5

    24e9bc794e235d1c01d3a8e64352c9bf

  • SHA1

    e3cfd7882fd7e2b05beeaa61637c1f53493710ce

  • SHA256

    66769b2562d5f335a8ea0279d98cfedfb1b1f980006d70f0a9aaf498235b97f5

  • SHA512

    2180ca9ec3482c8f92ee4b144a82c15f79ba078a7931dbd96fa7deb411d56ef2021c4c1bce2236dbb7a4a1eba51186a8cda1288e6c3072895c256c7b48bec673

  • SSDEEP

    6144:GpuUhxq8skkdM+22p1jdaCGICn+wV6aAOphyPMWSI:GQmRNQrE0aAOphyPMWX

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2