Extracted

• • Target

    2b36ac84fcaf5b888f8ed974369a858d9dd5e3ca2e7ff3be4e0ac697c7177581N

  • Size

    1.0MB

  • MD5

    bb64bee2678c3ad97a8d1243f25f1020

  • SHA1

    89a98429a22ddf320a87d1d48d09869858c4d9c7

  • SHA256

    2b36ac84fcaf5b888f8ed974369a858d9dd5e3ca2e7ff3be4e0ac697c7177581

  • SHA512

    e9b49a3f54db702b325ba8c1480690cba32462446228523f9b2be069e71eef170c4c9ad7d6d0dc8df37a0423af8228e38d1bb84da713cc7873e0a8f50a6e9026

  • SSDEEP

    24576:0NA3R5drX4GcPNYCgLplxEMJ7cPbLLnhyRWG+pkllQORg:V5/cPuRrxEM9CXN6WGmOi

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2