Extracted

• • Target

    Sleezy Perm Spoofer.exe

  • Size

    45KB

  • MD5

    3857559693c3664d1d4a23e347b22a97

  • SHA1

    901a46aa21849b31a78376103d132fd228b6c319

  • SHA256

    cb77bce6f9be0ea60169d0eaf76b5ef231c47f3996cccc75abc60f7d54dff7e8

  • SHA512

    5136d51473f2214ad83fa43c603839224ea736ba436e5ce67d8c1d57390e5969e075c6c8d3fb914f835ca42bf49b369e8962e64326f807b4a6badb5340ebec81

  • SSDEEP

    768:bdhO/poiiUcjlJInfTwH9Xqk5nWEZ5SbTDaJWI7CPW5M:Jw+jjgncH9XqcnW85SbTgWI0

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2