General

  • Target

    678b96022c012d5e9727bb314244bc57e96b3596a884025baa8704be3573de04

  • Size

    45KB

  • MD5

    e5c3a6908b77979c33b706b174665b57

  • SHA1

    8e4cd32dd51e5dc5c313d8dc2251d6f6f39d1673

  • SHA256

    678b96022c012d5e9727bb314244bc57e96b3596a884025baa8704be3573de04

  • SHA512

    1dc96382fed4c7083729b68a1994671a6e590f6d7b1a7e9bf1cf23fc6d4e7c7052affc3e11beb77f187131b93ea2ab44468fb76894e0d7fbe3894cea839282b0

  • SSDEEP

    768:qHdhO/poiiUcjlJInJ9SH9Xqk5nWEZ5SbTDaLuI7CPW5T7y:q9w+jjgnJoH9XqcnW85SbT2uIbO

Score
10/10

Malware Config

Extracted

Family

xenorat

C2

148.251.248.132

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    5000

  • install_path

    appdata

  • port

    46969

  • startup_name

    Update

Signatures

  • Detect XenoRat Payload 1 IoCs
  • Xenorat family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 678b96022c012d5e9727bb314244bc57e96b3596a884025baa8704be3573de04
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections