Extracted

• • Target

    lol.exe

  • Size

    45KB

  • MD5

    689b81ff8401ae3e6ee13845116b500b

  • SHA1

    270307d2166eea78f26b2a161e3b62b374f2505b

  • SHA256

    0e46779462358e8b75bdf29260b966155d8579ef902500d6c9296b01ee929fca

  • SHA512

    9795046cdaad8d1c59b3bfa3641518fffc6f0a47a0f82d7b373db00cec6b8a2aca77b75bfff0fed779fb8df39c2ba17aeb1ea1403bf1b6e58a3b4355695836f5

  • SSDEEP

    768:RdhO/poiiUcjlJInDTwH9Xqk5nWEZ5SbTDanWI7CPW5p:Pw+jjgnAH9XqcnW85SbTOWIR

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2behavioral3