Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
ImBetter.exe
-
Size
45KB
-
MD5
b6c160245a6d0a7978330729185fe3a5
-
SHA1
0c731d682d4acd18c151594e95e4b29c4501fc72
-
SHA256
b308143fdf4fa89fce16032af2bb2741cc116f0565b618fc76af52f424c631ad
-
SHA512
3c4c46134d057ac2e786f5492002189fb7b06ea9476e9e64edb43c4261ac13d3457d2078b8fda916d13869b651d57573cbcc1b7ee87e0a31a387d6968284fcf3
-
SSDEEP
768:RdhO/poiiUcjlJIn9TwH9Xqk5nWEZ5SbTDa5WI7CPW5Z:Pw+jjgneH9XqcnW85SbTwWIh
Malware Config
Extracted
xenorat
allow-property.gl.joinmc.link
Xeno_rat_nd8912d
-
delay
5000
-
install_path
nothingset
-
port
25565
-
startup_name
nothingset
Signatures
-
Detect XenoRat Payload 1 IoCs
resource yara_rule sample family_xenorat -
Xenorat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ImBetter.exe
Files
-
ImBetter.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ