General

  • Target

    Nitro.exe

  • Size

    45KB

  • Sample

    240914-2s1nqs1fjm

  • MD5

    048a4609bb110ca3e09bbfef1cc40c96

  • SHA1

    7d01285acc3f07037ab0254da3ec68bf4ceddb34

  • SHA256

    57f7eb514c99759aad8e22283c23dc974bb40d0b3bae8fe05fcbf5bd681382e1

  • SHA512

    fe2a26dd117df6eda626adb17d316010052098655fe794a37a5861290a4201b3bdc7eff184bcb93152a2e808bce82733dace9de143020c4748161e5ac28a4b1b

  • SSDEEP

    768:xdhO/poiiUcjlJInG1H9Xqk5nWEZ5SbTDaSuI7CPW5K:vw+jjgneH9XqcnW85SbTHuIi

Malware Config

Extracted

Family

xenorat

C2

148.0.169.121

Mutex

Nitro

Attributes
  • delay

    5000

  • install_path

    appdata

  • port

    4444

  • startup_name

    Nitro

Targets

    • Target

      Nitro.exe

    • Size

      45KB

    • MD5

      048a4609bb110ca3e09bbfef1cc40c96

    • SHA1

      7d01285acc3f07037ab0254da3ec68bf4ceddb34

    • SHA256

      57f7eb514c99759aad8e22283c23dc974bb40d0b3bae8fe05fcbf5bd681382e1

    • SHA512

      fe2a26dd117df6eda626adb17d316010052098655fe794a37a5861290a4201b3bdc7eff184bcb93152a2e808bce82733dace9de143020c4748161e5ac28a4b1b

    • SSDEEP

      768:xdhO/poiiUcjlJInG1H9Xqk5nWEZ5SbTDaSuI7CPW5K:vw+jjgneH9XqcnW85SbTHuIi

    • Detect XenoRat Payload

    • XenorRat

      XenorRat is a remote access trojan written in C#.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.