Extracted

• • Target

    Transferencia.exe

  • Size

    712KB

  • MD5

    205f93678f0207a93801654d71ddb792

  • SHA1

    4f5aa1639d9c85d93060ebecd17fbe7f0fef313c

  • SHA256

    3138fbe3448390de473a313644fd2a205e7e08de043d5097b37db857c40bfad0

  • SHA512

    0784187f0c40f1d428c3b982797f95c29485c43b8197ecaff305f926994222bc7e1f7de4f98205376a86f81676485c232f8732c1e756d159a5bf74d13f1f5a20

  • SSDEEP

    12288:JcrNS33L10QdrX4FBojL8DPNYnyV1Rotvwd2CO078/iY7Qlz9Rq/CvrvU:0NA3R5drX4GcPNYyr2voO078/iQI9RqN

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2