xenorat | f8eba74c284d814b491c66fb14fd772f7b9301eb654bba2932eaeb6be5eaf037N | Triage

Sharing

General

Target

f8eba74c284d814b491c66fb14fd772f7b9301eb654bba2932eaeb6be5eaf037N
Size

103KB
MD5

910251e7b8f59ea46dfc603fa4423ab0
SHA1

7291e9e7d51c5d2b9ef08ef1a24e990ea969ff2e
SHA256

f8eba74c284d814b491c66fb14fd772f7b9301eb654bba2932eaeb6be5eaf037
SHA512

4982f421e52fc229eff69bc3f2146c13b23e34d5d9e2e32e169d6b002be12c63eb41275a7d2d99a37e3cec751ee96b98f166dc557049a063b46effd3da9d21f6
SSDEEP

1536:yXVltIbTriWMk6gtQvdM/ThVIel133KSTkpfbVEhHg2Gkreu2g:yuvzM4tQvd2hBb3EBVEm2Gkreuj

Score

10^/10

xenorat

Malware Config

Signatures

Detect XenoRat Payload 1 IoCs

resource	yara_rule
sample	family_xenorat

Xenorat family
xenorat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f8eba74c284d814b491c66fb14fd772f7b9301eb654bba2932eaeb6be5eaf037N

Files

f8eba74c284d814b491c66fb14fd772f7b9301eb654bba2932eaeb6be5eaf037N
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

f59NjH
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ