Release (1).zip
- SHA256 8d940f5bb3e4d70b460961544d5cebdc9d64cb30354664a68dcbd31b3c836cae
Overview
overview
10Static
static
10Release (1...at.dll
windows10-2004-x64
1Release (1...er.dll
windows10-2004-x64
1Release (1...un.dll
windows10-2004-x64
1Release (1...nc.dll
windows10-2004-x64
1Release (1...ab.dll
windows10-2004-x64
1Release (1...er.dll
windows10-2004-x64
1Release (1...ne.dll
windows10-2004-x64
1Release (1...ne.dll
windows10-2004-x64
1Release (1...er.dll
windows10-2004-x64
1Release (1...er.dll
windows10-2004-x64
1Release (1...xy.dll
windows10-2004-x64
1Release (1...ol.dll
windows10-2004-x64
1Release (1...ll.dll
windows10-2004-x64
1Release (1...up.dll
windows10-2004-x64
1Release (1...er.dll
windows10-2004-x64
1Release (1...ss.dll
windows10-2004-x64
1Release (1...am.dll
windows10-2004-x64
1Release (1...nt.exe
windows10-2004-x64
10Release (1...er.exe
windows10-2004-x64
7Behavioral task
behavioral1
Sample
Release (1)/plugins/Chat.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
Release (1)/plugins/File manager.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Release (1)/plugins/Fun.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
Release (1)/plugins/Hvnc.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Release (1)/plugins/InfoGrab.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
Release (1)/plugins/KeyLogger.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Release (1)/plugins/KeyLoggerOffline.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
Release (1)/plugins/LiveMicrophone.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Release (1)/plugins/ProcessManager.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
Release (1)/plugins/Registry Manager.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Release (1)/plugins/ReverseProxy.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
Release (1)/plugins/ScreenControl.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Release (1)/plugins/Shell.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
Release (1)/plugins/Startup.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Release (1)/plugins/SystemPower.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
Release (1)/plugins/Uacbypass.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Release (1)/plugins/WebCam.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
Release (1)/stub/xeno rat client.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Release (1)/xeno rat server.exe
Resource
win10v2004-20241007-en
xenorat
localhost
testing 123123
1000
nothingset
1234
nothingset
| resource | yara_rule |
|---|---|
| static1/unpack001/Release (1)/plugins/Chat.dll | family_xenorat |
| static1/unpack001/Release (1)/plugins/File manager.dll | family_xenorat |
| static1/unpack001/Release (1)/plugins/Fun.dll | family_xenorat |
| static1/unpack001/Release (1)/plugins/Hvnc.dll | family_xenorat |
| static1/unpack001/Release (1)/plugins/InfoGrab.dll | family_xenorat |
| static1/unpack001/Release (1)/plugins/KeyLogger.dll | family_xenorat |
| static1/unpack001/Release (1)/plugins/KeyLoggerOffline.dll | family_xenorat |
| static1/unpack001/Release (1)/plugins/LiveMicrophone.dll | family_xenorat |
| static1/unpack001/Release (1)/plugins/ProcessManager.dll | family_xenorat |
| static1/unpack001/Release (1)/plugins/Registry Manager.dll | family_xenorat |
| static1/unpack001/Release (1)/plugins/ReverseProxy.dll | family_xenorat |
| static1/unpack001/Release (1)/plugins/ScreenControl.dll | family_xenorat |
| static1/unpack001/Release (1)/plugins/Shell.dll | family_xenorat |
| static1/unpack001/Release (1)/plugins/Startup.dll | family_xenorat |
| static1/unpack001/Release (1)/plugins/SystemPower.dll | family_xenorat |
| static1/unpack001/Release (1)/plugins/Uacbypass.dll | family_xenorat |
| static1/unpack001/Release (1)/plugins/WebCam.dll | family_xenorat |
| static1/unpack001/Release (1)/stub/xeno rat client.exe | family_xenorat |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/Release (1)/plugins/Chat.dll |
| unpack001/Release (1)/plugins/File manager.dll |
| unpack001/Release (1)/plugins/Fun.dll |
| unpack001/Release (1)/plugins/Hvnc.dll |
| unpack001/Release (1)/plugins/InfoGrab.dll |
| unpack001/Release (1)/plugins/KeyLogger.dll |
| unpack001/Release (1)/plugins/KeyLoggerOffline.dll |
| unpack001/Release (1)/plugins/LiveMicrophone.dll |
| unpack001/Release (1)/plugins/ProcessManager.dll |
| unpack001/Release (1)/plugins/Registry Manager.dll |
| unpack001/Release (1)/plugins/ReverseProxy.dll |
| unpack001/Release (1)/plugins/ScreenControl.dll |
| unpack001/Release (1)/plugins/Shell.dll |
| unpack001/Release (1)/plugins/Startup.dll |
| unpack001/Release (1)/plugins/SystemPower.dll |
| unpack001/Release (1)/plugins/Uacbypass.dll |
| unpack001/Release (1)/plugins/WebCam.dll |
| unpack001/Release (1)/stub/xeno rat client.exe |
| unpack001/Release (1)/xeno rat server.exe |
Detect XenoRat Payload
Unsigned PE
Checks for missing Authenticode signature.
Detect XenoRat Payload
Unsigned PE
Checks for missing Authenticode signature.
Detect XenoRat Payload
Unsigned PE
Checks for missing Authenticode signature.
Detect XenoRat Payload
Unsigned PE
Checks for missing Authenticode signature.
Detect XenoRat Payload
Unsigned PE
Checks for missing Authenticode signature.
Detect XenoRat Payload
Unsigned PE
Checks for missing Authenticode signature.
Detect XenoRat Payload
Unsigned PE
Checks for missing Authenticode signature.
Detect XenoRat Payload
Unsigned PE
Checks for missing Authenticode signature.
Detect XenoRat Payload
Unsigned PE
Checks for missing Authenticode signature.
Detect XenoRat Payload
Unsigned PE
Checks for missing Authenticode signature.
Detect XenoRat Payload
Unsigned PE
Checks for missing Authenticode signature.
Detect XenoRat Payload
Unsigned PE
Checks for missing Authenticode signature.
Detect XenoRat Payload
Unsigned PE
Checks for missing Authenticode signature.
Detect XenoRat Payload
Unsigned PE
Checks for missing Authenticode signature.
Detect XenoRat Payload
Unsigned PE
Checks for missing Authenticode signature.
Detect XenoRat Payload
Unsigned PE
Checks for missing Authenticode signature.
Detect XenoRat Payload
Unsigned PE
Checks for missing Authenticode signature.
Detect XenoRat Payload
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=8, id=241, version=40116,
count=139, id=243, version=40116,
count=13, id=242, version=40116,
count=2, id=253, version=31616,
count=18, id=260, version=31616,
count=10, id=259, version=31616,
count=57, id=261, version=31616,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=135, version=30729,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=291, id=1, productName=Unmarked objects,
count=50, id=261, version=31630,
count=1, id=256, version=31630,
count=1, id=255, version=31630,
count=1, id=258, version=31630,