General

  • Target
    image logger V2.zip
  • Size 163KB
  • Sample240908-25bkdaserf
  • SHA256 6f627ccaede437d4768d2bd22d6f9172077d45f239a1aeec8eaa75cf0f2f6f4d
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • xenorat

C2
  • 192.168.1.164

Attributes
  • delay

    5000

  • install_path

    nothingset

  • port

    4444

  • startup_name

    java updater

Targets

    • Target
      image logger V2/builder.py
    • Size 47KB
    • SHA256 1619c0ac9446408cb9ef09c2aeceee06883a9dc3ee527f6aa302436a5709a04d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      image logger V2/imageloggerV2.exe
    • Size 45KB
    • SHA256 a64fb3bf19974ad4369f1cbf8ab7cd5cf598462fb623788f9fd51b86b8361839
    • MD5 SHA1 SHA512 SSDEEP
    • Detect XenoRat Payload

    • XenorRat

      XenorRat is a remote access trojan written in C#.

    • Target
      image logger V2/loader.py
    • Size 651B
    • SHA256 7b1f5c9368279f6ef42b6cf507990aa3bc6b74a69d6b987237e051e3db8c9f07
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      image logger V2/tools/__pycache__/sigthief.cpython-311.pyc
    • Size 17KB
    • SHA256 a135714390bc953a2d9add7c448fdcd004c604f4e1fcfd9baf9621a6d6fc20da
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      image logger V2/tools/__pycache__/upx.cpython-311.pyc
    • Size 3KB
    • SHA256 a0069a2739d6c217d8f75e08cc9ca5c51d854cc1eb1ee20393e9a63ee04e22e0
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      image logger V2/tools/obfuscation.py
    • Size 17KB
    • SHA256 f16ebafbddde6335a329eb294bc5234cac3f2d36461a23b3ca0f5b0a5e3e1faa
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      image logger V2/tools/sigthief.py
    • Size 10KB
    • SHA256 9b7c335f3898b7b2564d1ab484c0b271a8c0e6ea679cf1390d1e6fce2553517a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      image logger V2/tools/update.py
    • Size 2KB
    • SHA256 58ce253dc08b47731e3ec7deebff297240cf7351ec3a832a3ca0c9a9dd55efb1
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      image logger V2/tools/updater.py
    • Size 1KB
    • SHA256 a06bf52c9e9961015d098860e17b0b6710c4ad656f717287be4786471cd5000d
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      image logger V2/tools/upx.py
    • Size 1018B
    • SHA256 4e243cf291985108ca727b92ffe43a74af6e4b692846572b0aa147735278f844
    • MD5 SHA1 SHA512
    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks