Extracted

• • Target

    b484589e-5bc1-4822-b761-fc942575461a.exe

  • Size

    1.0MB

  • MD5

    f32465a4fd980fa363d5572fa360b899

  • SHA1

    f47515752d398ff6a0ef2defcc438fdec954bd85

  • SHA256

    3304e525a58d809bbb50534a1288d1d9f5285bd77f313725cb48368642b10583

  • SHA512

    e2969efb4e82a4c2ae9ad1064e194d57771faa66d111f6be76946c04ad01b6777813290daf8ccded11601cd407843e51d729f20ad0f396ff6f13849f424085ef

  • SSDEEP

    24576:0NA3R5drX4GcPNY9C1ml38znrSQrcXVgxWGHEbpJvxB:V5/cPu4+45ra2xWBpp

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2