Extracted

• • Target

    c0e69f17e4280f555c04e474daea1550N

  • Size

    240KB

  • MD5

    c0e69f17e4280f555c04e474daea1550

  • SHA1

    aa4dab6524ff4454dccbfe18a2e9c7f4273c145f

  • SHA256

    f1cc57e8b861331e8bdad79a3823a919144e73da49879d1d326a8be2c20a47b9

  • SHA512

    62d61b9d852994e4b31b7aaf5d243b4c9ccb9d26846cb7e2ca0277e632eb7eff3429f4ab942d07bc9710a983ffeb875ee257fc2961d31a37d9a4eb2b119d8799

  • SSDEEP

    6144:nuwfQNZBN/yx3kJTcqszwMUrSXBO0YyoyXFPI:nuwYNI0JTrMO0YyoyXFg

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2