Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
xeno rat client.exe
Resource
win10-20240404-en
General
-
Target
xeno rat client.exe
-
Size
46KB
-
MD5
c754075d67934ef64baefa907672ba87
-
SHA1
c2e75338b0ccd804ce09ff74a4897ebdfe1fd5af
-
SHA256
ee83bde159850a3c16d9186e142809ad93be3af768dd548ff25a57994e4c3e10
-
SHA512
2415c2b11002633b3e8018cda4d8a54c1e67bd146a6ab525b0737a757e1a4835b60dbf051f5259f5473c08fa44928a8c10b43215f0839bf063c08b34b182936e
-
SSDEEP
768:iC3hw+tAquCAjmkI7UG5Gw9Xqcc5FagvH4bZDa3jAI7irW5R:icelHjg76w9XqcEFa0H4bZSjAI9
Malware Config
Signatures
-
Xenorat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource xeno rat client.exe
Files
-
xeno rat client.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ