Extracted

• • Target

    XenoClient.exe

  • Size

    45KB

  • MD5

    7c43e5708ceb4163da1dce1843eb8bce

  • SHA1

    e624c8ee2b16127d40b4f45843d3e32899a734d7

  • SHA256

    357cbb546779bfe9e7b3772d6c15a21bad8029f2622dbf8f53c6aa8f0fe29a27

  • SHA512

    b9c61bd67b3daf00f6794f4cdc4051c6771a1bf1671edb733286123986d0f53436d809afae5101fab1ac8aacbf89aa7817e64cced16d163c1c566fab2c9e6c4e

  • SSDEEP

    768:vdhO/poiiUcjlJInsqH9Xqk5nWEZ5SbTDaxWI7CPW50:lw+jjgnHH9XqcnW85SbTIWIM

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2