General

  • Target

    Xeno.exe

  • Size

    45KB

  • Sample

    241012-d61c5a1dqh

  • MD5

    7a3b28f412c9cc6c9d6c30cce8e7c0bc

  • SHA1

    afeb0bf2a0618701c0e8f25fe5905b8e0ae0da0b

  • SHA256

    84f1754b8db0c2b85a04e1b80f0b1f5aba825c7ce500edf5d33e9495638257a3

  • SHA512

    9800a057b6e9ba328686a171ee9a5252af0659c661b0713c0149a4eff22607ac29a115e2f1fd507eab35ef8c192cb9c5b6e96262e12cff33284bbd643ace9b45

  • SSDEEP

    768:tdhO/poiiUcjlJInr7ElmH9Xqk5nWEZ5SbTDaKuI7CPW5F:jw+jjgn3ElmH9XqcnW85SbTPuIN

Malware Config

Extracted

Family

xenorat

C2

192.168.1.88

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    5000

  • install_path

    nothingset

  • port

    54710

  • startup_name

    nothingset

Targets

    • Target

      Xeno.exe

    • Size

      45KB

    • MD5

      7a3b28f412c9cc6c9d6c30cce8e7c0bc

    • SHA1

      afeb0bf2a0618701c0e8f25fe5905b8e0ae0da0b

    • SHA256

      84f1754b8db0c2b85a04e1b80f0b1f5aba825c7ce500edf5d33e9495638257a3

    • SHA512

      9800a057b6e9ba328686a171ee9a5252af0659c661b0713c0149a4eff22607ac29a115e2f1fd507eab35ef8c192cb9c5b6e96262e12cff33284bbd643ace9b45

    • SSDEEP

      768:tdhO/poiiUcjlJInr7ElmH9Xqk5nWEZ5SbTDaKuI7CPW5F:jw+jjgn3ElmH9XqcnW85SbTPuIN

    • Detect XenoRat Payload

    • XenorRat

      XenorRat is a remote access trojan written in C#.

MITRE ATT&CK Enterprise v15

Tasks