General

  • Target

    R2Cheats_unstable.exe

  • Size

    45KB

  • Sample

    241018-3wmrqaxamp

  • MD5

    13449a087b4f8d0874ddd4c406059870

  • SHA1

    f70582bdd96611bb2ccc9152e0129992f1c898d2

  • SHA256

    e1e86016c8212f38c9b64f32b0a621c36485805b4ff2e2263f4fa9bfe30115e3

  • SHA512

    6bc8711459dd5ba11f65321b98b257b1dd65f0c4fc22b86577d27c6d4257ea533f5db8c62d9782966fad2d05922b65d0e64bcb641b7a4335b924d760812f2447

  • SSDEEP

    768:mMdhO/poiiUcjlJIn4qH9Xqk5nWEZ5SbTDa5WI7CPW5V:mGw+jjgnTH9XqcnW85SbTQWId

Malware Config

Extracted

Family

xenorat

C2

192.168.0.161

Mutex

R2Cheats_Beta_Unstable

Attributes
  • delay

    1000

  • install_path

    temp

  • port

    4444

  • startup_name

    Chrome Updater

Targets

    • Target

      R2Cheats_unstable.exe

    • Size

      45KB

    • MD5

      13449a087b4f8d0874ddd4c406059870

    • SHA1

      f70582bdd96611bb2ccc9152e0129992f1c898d2

    • SHA256

      e1e86016c8212f38c9b64f32b0a621c36485805b4ff2e2263f4fa9bfe30115e3

    • SHA512

      6bc8711459dd5ba11f65321b98b257b1dd65f0c4fc22b86577d27c6d4257ea533f5db8c62d9782966fad2d05922b65d0e64bcb641b7a4335b924d760812f2447

    • SSDEEP

      768:mMdhO/poiiUcjlJIn4qH9Xqk5nWEZ5SbTDa5WI7CPW5V:mGw+jjgnTH9XqcnW85SbTQWId

    • Detect XenoRat Payload

    • XenorRat

      XenorRat is a remote access trojan written in C#.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks