Extracted

• • Target

    horionexecutor.exe

  • Size

    468KB

  • MD5

    2eb0ea8d72d333361e25d0098cf9e3f9

  • SHA1

    ca83c1003b89271df09d3930a21693916d9bdf00

  • SHA256

    c9b145d19869e40e615086a5b158fca378b0098dc3621991eff2c43b67435863

  • SHA512

    6ad5bc8cf4ef20d5965b20b2f2fa7e4ba23f397d150f9ea4803d64ee1f58ae0eadce4eddd3ea44eee7f05a7541759897e4891a168d4b2b371935be40a1e9baab

  • SSDEEP

    3072:Gw+jqS91UbTiEy5dUBoqcPvSqqw1QHgtUOJ/yDPjPVc2WLiK4XVfI2a:zWb91Ub2dXrSYiEnJ8b22Wo

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2