Extracted

• • Target

    678b96022c012d5e9727bb314244bc57e96b3596a884025baa8704be3573de04

  • Size

    45KB

  • MD5

    e5c3a6908b77979c33b706b174665b57

  • SHA1

    8e4cd32dd51e5dc5c313d8dc2251d6f6f39d1673

  • SHA256

    678b96022c012d5e9727bb314244bc57e96b3596a884025baa8704be3573de04

  • SHA512

    1dc96382fed4c7083729b68a1994671a6e590f6d7b1a7e9bf1cf23fc6d4e7c7052affc3e11beb77f187131b93ea2ab44468fb76894e0d7fbe3894cea839282b0

  • SSDEEP

    768:qHdhO/poiiUcjlJInJ9SH9Xqk5nWEZ5SbTDaLuI7CPW5T7y:q9w+jjgnJoH9XqcnW85SbT2uIbO

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2