Overview

overview

10

Static

static

10

better.exe

windows7-x64

10

better.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    better.exe

  • Size

    45KB

  • MD5

    e1ceac9336a96cb04cc3909ba406b535

  • SHA1

    f511cbbd228c9685067bdc81d2411031285e1c75

  • SHA256

    36c3156427b6f44bbd149994ae17c422b99efc92a1dd846bf23c2e499a639232

  • SHA512

    85d889cad787945820bf2c37d8bf4072dfbb13e692258b6efc00ed6ab4ec1790b1b235d0e034edd1812376ba70d650e1eb3cb95cb3bd61d91b2fb3cbd65bf6ed

  • SSDEEP

    768:AdhO/poiiUcjlJIn89SH9Xqk5nWEZ5SbTDaxuI7CPW5G:yw+jjgn8oH9XqcnW85SbTkuI+

Score
10/10
xenorat

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

Xeno_rat_nd8912d

Attributes
  • install_path

    appdata

  • port

    4782

  • startup_name

    Arkhavis.exe

Signatures

  • Detect XenoRat Payload 1 IoCs
  • Xenorat family
    xenorat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • better.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections