Extracted

• • Target

    4079c8b353cbed438c29fe62ff7315fea2a90ff3cc16055801939f647d2f2d26.exe

  • Size

    45KB

  • MD5

    933eb414285ea29140928e633e8ec34e

  • SHA1

    228a81ed40af52d0d4f7740401440c2d9a8e496d

  • SHA256

    4079c8b353cbed438c29fe62ff7315fea2a90ff3cc16055801939f647d2f2d26

  • SHA512

    71fc1a046d3b60dd91ee6d6bd4d9d433d5361f02d781a56b9677ba02748497c0284288dc128cce24438bc22ab3fc6256882744ac63a35061cf692d8aec088868

  • SSDEEP

    768:wdhO/poiiUcjlJIn4hYH9Xqk5nWEZ5SbTDaEbuI7CPW5W:iw+jjgn4SH9XqcnW85SbThbuIe

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2