Behavioral task
behavioral1
Sample
172902986672873fc57bef089ff09181fda339003de51f91ee58b41976ae1ebaf3ad7dd31e442.dat-decoded.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
172902986672873fc57bef089ff09181fda339003de51f91ee58b41976ae1ebaf3ad7dd31e442.dat-decoded.exe
Resource
win10v2004-20241007-en
General
-
Target
172902986672873fc57bef089ff09181fda339003de51f91ee58b41976ae1ebaf3ad7dd31e442.dat-decoded.exe
-
Size
46KB
-
MD5
893e1ee1146765fd290cd4f963250a55
-
SHA1
b60df5f948b65a55789c6a08d2de756603e1a81f
-
SHA256
45d32d2bcbd32fe8ca74472498a2a7429d1ce6fd5ea7283892ed81f128ca8ca1
-
SHA512
f1e118fba94d07d937b66eb1b9c23ca632b7edf7b89bd8e1873750014604b2b1c3bae0a985ec4336087fe54667ed47dd1043fd25671c93fa95d315bb27cacedb
-
SSDEEP
768:fC3hw+tAquCAjmkI70GXGw9Xqcc5FagvH4bZDaruI7ehW5F:fcelHjg7cw9XqcEFa0H4bZyuIf
Malware Config
Signatures
-
Detect XenoRat Payload 1 IoCs
resource yara_rule sample family_xenorat -
Xenorat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 172902986672873fc57bef089ff09181fda339003de51f91ee58b41976ae1ebaf3ad7dd31e442.dat-decoded.exe
Files
-
172902986672873fc57bef089ff09181fda339003de51f91ee58b41976ae1ebaf3ad7dd31e442.dat-decoded.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ