Overview

overview

10

Static

static

10

yes.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    yes.exe

  • Size

    45KB

  • MD5

    c56ec548db6d8adab14605421dc116e3

  • SHA1

    1d440b7cbea0497cfcaf1dfa3f681d9a0d15a5a8

  • SHA256

    067884413fb4c673359b6a154e428d3f91a6bd7b5d9c98428edc5cd7e327c97b

  • SHA512

    c8459f677a608ff54cbb030f934f3d58636e19651d0a2e383500b80bbf9cd4c399341e34dd495afadd26ebcc1addd22bdfff2a45357939ce25c116c600e8d510

  • SSDEEP

    768:gdhO/poiiUcjlJInpb+Ya3H9Xqk5nWEZ5SbTDa7uI7CPW5i:Sw+jjgnsH9XqcnW85SbTGuI6

Score
10/10
xenorat

Malware Config

Extracted

Family

xenorat

C2

198.44.133.131

Mutex

Attributes
  • delay

    5000

  • install_path

    appdata

  • port

    13579

  • startup_name

    Windows CL

Signatures

  • Detect XenoRat Payload 1 IoCs
  • Xenorat family
    xenorat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • yes.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections