Extracted

• • Target

    a613c952168c9a5fb4bd937d036857f1759a0dde6019f147d41df1ccf3aeedf7.exe

  • Size

    45KB

  • MD5

    8d16c9b3848f78fc49cb51dfe233bf5a

  • SHA1

    9256f7b300ceea8a10385a43e94dea1636aebda6

  • SHA256

    a613c952168c9a5fb4bd937d036857f1759a0dde6019f147d41df1ccf3aeedf7

  • SHA512

    65969c38e4a1dde8e42d64e200f93f529810e63d99cbefc77fe652fef5cc8f69115bf02b22f53b6249b0aff171e0ca6fcb89b4e40301d34ec4cecda4d40395c7

  • SSDEEP

    768:adhM/poiiUcjlJInf4NRgHNYfYtSKTnW+Z5CmbJODog63I7CPW5a:82+jjgnQNQNYADTnWK5rboL63IC

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2