Extracted

• • Target

    59ac0f6935c6289c99cf0b8f46f595b021dc744f0b85472a861e534e3da74f1bN

  • Size

    69KB

  • MD5

    2faacc30154f19cccca656151220cdd0

  • SHA1

    131963b866a54f15fe04874c70af53561417665c

  • SHA256

    59ac0f6935c6289c99cf0b8f46f595b021dc744f0b85472a861e534e3da74f1b

  • SHA512

    626598071453ff993b05f9c6c7468aebd299fc5b8ee29a7c2f5b093b1e968c548288812d83c1f3717ce28330649e93a8d51f39c1f7c853ce6180ffae520b3f39

  • SSDEEP

    1536:2w+jjgn5lF2I8H9XqcnW85SbTVuIVUppzz3NuKTHoW9QurRkWO:2w+jq5lFfG91UbTVb0VLxh9QMWWO

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2