Analysis
-
max time kernel
132s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
05-11-2024 02:05
General
-
Target
1900_Flycode_VPN_installer_exe.exe
-
Size
228KB
-
MD5
16a9b74cf6e1432383b08858eaa26ac5
-
SHA1
b893c8c9dc16546a0a70c85ba46691a7923c94ee
-
SHA256
c7572eea253f05acf9e85f87d2d63b1e567dafb0525df5447ba981f72cef52fb
-
SHA512
9e461c2e35fdefd44022e8b09f302d3bb8532c01e0fe4128229c9a63cfb99d838d24b84f939a76b49744233be18d90eaeb1cee2b2d9972b6162d6f68a77bd438
-
SSDEEP
3072:gYO50g6Ej5cgvRFjzx1g+I8VW68kQQCH+ZbZDE1JYnI3yt:WjcgnXx1g+I8Vz9QQCeZbtoJYi
Score
10/10
Malware Config
Signatures
-
Detect XenoRat Payload 1 IoCs
-
XenorRat
XenorRat is a remote access trojan written in C#.
-
Xenorat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1900_Flycode_VPN_installer_exe.exe"C:\Users\Admin\AppData\Local\Temp\1900_Flycode_VPN_installer_exe.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB