Overview

overview

10

Static

static

10

Blue.ccTempWoofer.exe

windows7-x64

10

Blue.ccTempWoofer.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Blue.ccTempWoofer.exe

  • Size

    282KB

  • Sample

    241010-sbv79awhpp

  • MD5

    bd58be40cf8514257afa679943e3d985

  • SHA1

    6c1e0bfcdb791e4dc392983f750d41750ff03f0d

  • SHA256

    8ea18eece31949fcbf403dcd372a686cb70cb41272c3fade7248a272d74a003a

  • SHA512

    9b7ba96204c0a7987fba24a9fee589edc19737445fb007eb687c3b3f037a412d550f9315835b95f7cef74a37d2b6f85bd00d7e6086ef38b4154d4001febe8f3c

  • SSDEEP

    1536:9w+jjgneH9XqcnW85SbTCWIa7tMuBtzGulxuJVZ2eY7WHpqiH:9w+jqA91UbTC2t7leZ2eWNo

Score
10/10
xenoratdiscoveryrattrojan

Malware Config

Extracted

Family

xenorat

C2

192.168.244.72

Mutex

Blue.cc Temp Woofer

Attributes
  • delay

    10

  • install_path

    nothingset

  • port

    4444

  • startup_name

    nothingset

Targets

    • Target

      Blue.ccTempWoofer.exe

    • Size

      282KB

    • MD5

      bd58be40cf8514257afa679943e3d985

    • SHA1

      6c1e0bfcdb791e4dc392983f750d41750ff03f0d

    • SHA256

      8ea18eece31949fcbf403dcd372a686cb70cb41272c3fade7248a272d74a003a

    • SHA512

      9b7ba96204c0a7987fba24a9fee589edc19737445fb007eb687c3b3f037a412d550f9315835b95f7cef74a37d2b6f85bd00d7e6086ef38b4154d4001febe8f3c

    • SSDEEP

      1536:9w+jjgneH9XqcnW85SbTCWIa7tMuBtzGulxuJVZ2eY7WHpqiH:9w+jqA91UbTC2t7leZ2eWNo

    Score
    10/10
    xenoratdiscoveryrattrojan

    • Detect XenoRat Payload

    • XenorRat

      XenorRat is a remote access trojan written in C#.

      trojanratxenorat
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks