Overview

overview

10

Static

static

10

Beda-Execu...TA.exe

windows7-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Beda-Executor-BETA.exe

  • Size

    46KB

  • Sample

    241020-debwfswhqq

  • MD5

    09dbfc1d03bf12e1c49086e5686ed71d

  • SHA1

    6faf2c9afe5baf71f983adc76ec0c772e1f54fa9

  • SHA256

    55b673feb6d0421068371f155aad3eb46e3e409dcb8e8b1f868ed055246a8d9c

  • SHA512

    632114c35378aaffd8835327aca9693a27331819527aca6e42c68a2c3b0bfdee53d93e3924439c1f9c21eca6b9f76c3aeb28417b3ac5291b360fa69420b70308

  • SSDEEP

    768:1dhO/poiiUcjlJInGzH9Xqk5nWEZ5SbTDaaWI7CPW55:Lw+jjgnEH9XqcnW85SbT7WIx

Score
10/10
xenoratdiscoveryrattrojan

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

beda_sa_nd8912d

Attributes
  • delay

    5000

  • install_path

    appdata

  • port

    4449

  • startup_name

    WinSec

Targets

    • Target

      Beda-Executor-BETA.exe

    • Size

      46KB

    • MD5

      09dbfc1d03bf12e1c49086e5686ed71d

    • SHA1

      6faf2c9afe5baf71f983adc76ec0c772e1f54fa9

    • SHA256

      55b673feb6d0421068371f155aad3eb46e3e409dcb8e8b1f868ed055246a8d9c

    • SHA512

      632114c35378aaffd8835327aca9693a27331819527aca6e42c68a2c3b0bfdee53d93e3924439c1f9c21eca6b9f76c3aeb28417b3ac5291b360fa69420b70308

    • SSDEEP

      768:1dhO/poiiUcjlJInGzH9Xqk5nWEZ5SbTDaaWI7CPW55:Lw+jjgnEH9XqcnW85SbT7WIx

    Score
    10/10
    xenoratdiscoveryrattrojan

    • Detect XenoRat Payload

    • XenorRat

      XenorRat is a remote access trojan written in C#.

      trojanratxenorat

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks