Extracted

• • Target

    Pago Pendiente.exe

  • Size

    349KB

  • MD5

    801c9030471f7628b4d4420f5f39d4bc

  • SHA1

    2ba63101806334f1ea3460c3eec88bb413a850a9

  • SHA256

    e549d0806346bc3a34579c8af334c61be85c169bf735deb49de85b70bad3549a

  • SHA512

    7255144d46c2e642ae5399ad5040c7bce508f2b332ef55d6c3cfe6450dcc0c9d8356618b439d35c177648c8fc3d06644d39ca0df431f082207bafb1445d4aa32

  • SSDEEP

    6144:Gha3BXN9O4vSGmZnKkJZNGXsPrN9HbPWqqGHRZI:Ca3B9xSGmZn5+XWR9HbPWqqGHE

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2