Extracted

• • Target

    XenoClient.exe

  • Size

    45KB

  • MD5

    0cdc550a2b12b4a09baa7300a578169e

  • SHA1

    882388f7d2afad43a7e2414ea7d0ed7c3a305498

  • SHA256

    924068f7acdcc98bcdde9c3ea8ddfb323178fa70800b88f2ef79a51f5af6840a

  • SHA512

    d8f62c31b4f904b3fb149c3359a917830fe6b585d15e3dabd69fb76afb033564181dfc04182cac6dbd13b7f0c058ced8c79b2b51fc15284492a09527ace82268

  • SSDEEP

    768:bdhO/poiiUcjlJInITwH9Xqk5nWEZ5SbTDa2WI7CPW5p:Jw+jjgn5H9XqcnW85SbTXWIR

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2