Extracted

• • Target

    XenoClient.exe

  • Size

    45KB

  • MD5

    1875c2ce26eb017938b66dc856c92df4

  • SHA1

    9a2f79b095f15df62feb27bbf433e002cf12074b

  • SHA256

    43636464ded3e9c31b2a19daa2e3307b80d67dae23e7e8cf043edddfff289b57

  • SHA512

    6211da4b88fba3d805c159e2fa35856512d8c22dc865d42ad795ce026491eb48a6fe539ba981e95ae90532afebbc8a1dc9cfb33bf06094e302577d38ab25e06a

  • SSDEEP

    768:vdhO/poiiUcjlJInKqH9Xqk5nWEZ5SbTDaxWI7CPW50:lw+jjgnJH9XqcnW85SbTIWIM

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2