Extracted

• • Target

    Te.exe

  • Size

    45KB

  • MD5

    eaec451acfbf48b54a7b45bd13539501

  • SHA1

    89294006ab45dd517ba8d557cc6c31293b7e730b

  • SHA256

    bafe5e904cddcc11afd3135e58a736ccd055ffe4e217acde4289780e2801312f

  • SHA512

    ac4e3427d9de004bf60ed4a91844a36395c3164902482c7d6ee37f76fa962149364544c52553f6b3ea7f1d032849ee54187401556a68f3ae3747228257b7b7c1

  • SSDEEP

    768:6dhO/poiiUcjlJInJgH9Xqk5nWEZ5SbTDaSWI7CPW5M:cw+jjgnOH9XqcnW85SbTbWIU

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2