xenorat | 2[.]exe | Triage

Sharing

General

Target

2.exe
Size

282KB
MD5

2a73d33b40a0b8f18d6a814c6299fd01
SHA1

05c6a7254a485745467b6488321b887ef4c44b81
SHA256

43deac03fa50ed30cb74e3882573d90df257539d21e92f142f9d82d41f397513
SHA512

366771ed993254d883bd5ca43cf0c145f53bff2b8db6b6f49270a03761473a1a43dfe35461b301b1e4313c40a99cae4a55fdd6d607777a9e12c0bc5dfa857c20
SSDEEP

1536:nw+jjgn6H9XqcnW85SbTEuIO7tMuBtzGulxuJVZ2eY7WHpqiH:nw+jq091UbTESt7leZ2eWNo

Score

10^/10

xenorat

Malware Config

Extracted

Family

xenorat

C2

192.168.244.1

Mutex

Blue.cc Temp Woofer

Attributes

delay
10
install_path
nothingset
port
4444
startup_name
nothingset

Signatures

Detect XenoRat Payload 1 IoCs

resource	yara_rule
sample	family_xenorat

Xenorat family
xenorat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2.exe

Files

2.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 238KB - Virtual size: 238KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ