Extracted

• • Target

    7dad8bde1930921c2dd4b769af27b5aa9b3889688ac7270d5807187335d2fcc4

  • Size

    45KB

  • MD5

    722eb89eb60b302bc2e07bc5fe73455a

  • SHA1

    5af9d5b2ad0891e86170bad7e29f15fb0089ff97

  • SHA256

    7dad8bde1930921c2dd4b769af27b5aa9b3889688ac7270d5807187335d2fcc4

  • SHA512

    fe8ac25aee120c929614068a8315e4646572fd4d9ba0be55fef3ec59413b1a0d2a45016f357b699fba436f05ffa951cab2ed3c80ff7c666125f100da849d2a6b

  • SSDEEP

    768:xdhO/poiiUcjlJInxQH9Xqk5nWEZ5SbTDan0WI7CPW5Z:vw+jjgnqH9XqcnW85SbTG0WIx

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2