Extracted

• • Target

    Atlantisrat.exe

  • Size

    250KB

  • MD5

    6d6b39d2de6789a8c1ebb5b22401bc7b

  • SHA1

    6cec48b082e8839871edd8cebf7df6529a989d66

  • SHA256

    2f2764f4cf7f147d0e05ebc817329e4ee20f9abf41bf2d18a0422b6e74525382

  • SHA512

    a71802ed767b38ad785e5435fcd601f4a650ba6ba863ae1171ee16f3aa7bca4bdf6bcf2dece91557893eb777b76995de2a25f02327839f8d3ee363257c089fbb

  • SSDEEP

    1536:Pw+jjgnyH9XqcnW85SbTvWIFAZ+r/cttjNFH1MB53FvSvoKi8G:Pw+jqs91UbTvE+ri0NgvFi8G

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2