Overview

overview

10

Static

static

10

Horionexexecutor.exe

windows7-x64

10

Horionexexecutor.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Horionexexecutor.exe

  • Size

    468KB

  • Sample

    241013-v8s59sygkb

  • MD5

    59f30931892470045a237180c4df3566

  • SHA1

    54cd26c02a62cb7af4756b74659bd275e3647fdc

  • SHA256

    b9e7ce8956dcb00b56b550035d339beb309d227e907b0b2037ac1278b0711524

  • SHA512

    091f00e46f8632591c43db97a5b32564fc5fee6a8267bb196209b8e7b914348bfe64c2333df8aba1b2f289882bb90db781fc1c8f55445c88899b572305e87799

  • SSDEEP

    3072:mw+jq8yeF91UbTqLy5dUBoqcPvSqqw1QHgtUOJ/yDPjPVc2WLiK4XVfI2j:TW7yeF91UbHdXrSYiEnJ8b22Wo

Score
10/10
xenoratdiscoveryrattrojan

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

horion executor

Attributes
  • delay

    5000

  • install_path

    appdata

  • port

    4444

  • startup_name

    horion executor

Targets

    • Target

      Horionexexecutor.exe

    • Size

      468KB

    • MD5

      59f30931892470045a237180c4df3566

    • SHA1

      54cd26c02a62cb7af4756b74659bd275e3647fdc

    • SHA256

      b9e7ce8956dcb00b56b550035d339beb309d227e907b0b2037ac1278b0711524

    • SHA512

      091f00e46f8632591c43db97a5b32564fc5fee6a8267bb196209b8e7b914348bfe64c2333df8aba1b2f289882bb90db781fc1c8f55445c88899b572305e87799

    • SSDEEP

      3072:mw+jq8yeF91UbTqLy5dUBoqcPvSqqw1QHgtUOJ/yDPjPVc2WLiK4XVfI2j:TW7yeF91UbHdXrSYiEnJ8b22Wo

    Score
    10/10
    xenoratdiscoveryrattrojan

    • Detect XenoRat Payload

    • XenorRat

      XenorRat is a remote access trojan written in C#.

      trojanratxenorat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks