Overview

overview

10

Static

static

10

better.exe

windows7-x64

10

better.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    better.exe

  • Size

    45KB

  • Sample

    240912-zmtl5atflk

  • MD5

    e1ceac9336a96cb04cc3909ba406b535

  • SHA1

    f511cbbd228c9685067bdc81d2411031285e1c75

  • SHA256

    36c3156427b6f44bbd149994ae17c422b99efc92a1dd846bf23c2e499a639232

  • SHA512

    85d889cad787945820bf2c37d8bf4072dfbb13e692258b6efc00ed6ab4ec1790b1b235d0e034edd1812376ba70d650e1eb3cb95cb3bd61d91b2fb3cbd65bf6ed

  • SSDEEP

    768:AdhO/poiiUcjlJIn89SH9Xqk5nWEZ5SbTDaxuI7CPW5G:yw+jjgn8oH9XqcnW85SbTkuI+

Score
10/10
xenoratdiscoveryrattrojan

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

Xeno_rat_nd8912d

Attributes
  • install_path

    appdata

  • port

    4782

  • startup_name

    Arkhavis.exe

Targets

    • Target

      better.exe

    • Size

      45KB

    • MD5

      e1ceac9336a96cb04cc3909ba406b535

    • SHA1

      f511cbbd228c9685067bdc81d2411031285e1c75

    • SHA256

      36c3156427b6f44bbd149994ae17c422b99efc92a1dd846bf23c2e499a639232

    • SHA512

      85d889cad787945820bf2c37d8bf4072dfbb13e692258b6efc00ed6ab4ec1790b1b235d0e034edd1812376ba70d650e1eb3cb95cb3bd61d91b2fb3cbd65bf6ed

    • SSDEEP

      768:AdhO/poiiUcjlJIn89SH9Xqk5nWEZ5SbTDaxuI7CPW5G:yw+jjgn8oH9XqcnW85SbTkuI+

    Score
    10/10
    xenoratdiscoveryrattrojan

    • Detect XenoRat Payload

    • XenorRat

      XenorRat is a remote access trojan written in C#.

      trojanratxenorat

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks