Extracted

• • Target

    6c7ccc122fac3ed22879b0b82b2874a375ec923682712.exe

  • Size

    45KB

  • MD5

    bb8712b4382955760eb56b2db9f1965d

  • SHA1

    b40feb63f86dca36a4accb9b96aff9bf95b1eb43

  • SHA256

    6c7ccc122fac3ed22879b0b82b2874a375ec9236827127ec784eafc607740a83

  • SHA512

    a592e17c3a417a4a50c5b45800ff1db3514ddeb70b6153e5c9ebfb1f13d4482035847d313e188e6158f4eb527a471f25d8d53762d9c812fa6932794084f036e4

  • SSDEEP

    768:NdhO/poiiUcjlJInywH9Xqk5nWEZ5SbTDa6WI7CPW5c:Dw+jjgnLH9XqcnW85SbT7WIk

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2