Extracted

• • Target

    test1.exe

  • Size

    45KB

  • MD5

    1bc7383490469b2c41ef12cad90f5532

  • SHA1

    f124850ee6059f784025801534bc11416a42f518

  • SHA256

    35ba9ddc3b170aa93a127f0fd5a6420b3643c08217be27f1253cfe2622beff81

  • SHA512

    72e5b8860776db408d053c327a2bd9c5f6a30c6c8d01f86bb42e56180c835bda0797d03e746009cc6ed0a8c2e9079936f245551f62913a7086da9b0148b9fd02

  • SSDEEP

    768:ldhO/poiiUcjlJInsqH9Xqk5nWEZ5SbTDaPWI7CPW59:7w+jjgnHH9XqcnW85SbTuWIl

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2