xenorat | 7dad8bde1930921c2dd4b769af27b5aa9b3889688ac7270d5807187335d2fcc4 | Triage

Sharing

General

Target

7dad8bde1930921c2dd4b769af27b5aa9b3889688ac7270d5807187335d2fcc4
Size

45KB
MD5

722eb89eb60b302bc2e07bc5fe73455a
SHA1

5af9d5b2ad0891e86170bad7e29f15fb0089ff97
SHA256

7dad8bde1930921c2dd4b769af27b5aa9b3889688ac7270d5807187335d2fcc4
SHA512

fe8ac25aee120c929614068a8315e4646572fd4d9ba0be55fef3ec59413b1a0d2a45016f357b699fba436f05ffa951cab2ed3c80ff7c666125f100da849d2a6b
SSDEEP

768:xdhO/poiiUcjlJInxQH9Xqk5nWEZ5SbTDan0WI7CPW5Z:vw+jjgnqH9XqcnW85SbTG0WIx

Score

10^/10

xenorat

Malware Config

Extracted

Family

xenorat

C2

syfhnuc714-20814.portmap.host

Mutex

Celex_Cracked

Attributes

delay
5000
install_path
temp
port
8080
startup_name
Steam_Service

Signatures

Xenorat family
xenorat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7dad8bde1930921c2dd4b769af27b5aa9b3889688ac7270d5807187335d2fcc4

Files

7dad8bde1930921c2dd4b769af27b5aa9b3889688ac7270d5807187335d2fcc4
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ