Extracted

• • Target

    3688756f43ff292c6431c90f7928dec6.exe

  • Size

    354KB

  • MD5

    3688756f43ff292c6431c90f7928dec6

  • SHA1

    dadf075fdc48d59398c97e3e9a83fcb45a75e02a

  • SHA256

    1c19018dec9dbe68fc48099c662be25062e7a43e6658bf396c6cc8fb2f6d21af

  • SHA512

    e7754f895eb8010f9aa65b476ece542ece987a5fa78cf8f4806086186f738619bd999a9f6ee416c6b64fd98dc45b05a6c20a9bb0ca1f26fe0478eee69763e4e8

  • SSDEEP

    6144:7ogIz4+0PtWd4hNC2f38OdLdBTEK1DedgwbjBBJsDqB4DK0hH2I:7ogIzye2/8O9dSK1M3BBJsDqB4DK0ZL

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2