Extracted

• • Target

    469aeffa2304a243bfa555589979bb3ccdb19f75842873805e7f522f15a87426.exe

  • Size

    285KB

  • MD5

    d0ddfcddb1269b9e2edb00cd7edae575

  • SHA1

    2dc7c44b3e204f863f78b81d08fc73806137ad33

  • SHA256

    469aeffa2304a243bfa555589979bb3ccdb19f75842873805e7f522f15a87426

  • SHA512

    8f507f027717426a91e0e766c0d441881faa120d2950bad90b40fa9fe18158369a5e97510357cc09c9ab1ea98903142acca1d783b40536f85332e7bd6e7b44b1

  • SSDEEP

    6144:+5tgf4emOsrVHWfrhV+YKFOWr157wugSzX0Yo8PI:+MwhUfrhV+YKYWr157wugSzX0Yov

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2