Extracted

• • Target

    yes.exe

  • Size

    45KB

  • MD5

    c56ec548db6d8adab14605421dc116e3

  • SHA1

    1d440b7cbea0497cfcaf1dfa3f681d9a0d15a5a8

  • SHA256

    067884413fb4c673359b6a154e428d3f91a6bd7b5d9c98428edc5cd7e327c97b

  • SHA512

    c8459f677a608ff54cbb030f934f3d58636e19651d0a2e383500b80bbf9cd4c399341e34dd495afadd26ebcc1addd22bdfff2a45357939ce25c116c600e8d510

  • SSDEEP

    768:gdhO/poiiUcjlJInpb+Ya3H9Xqk5nWEZ5SbTDa7uI7CPW5i:Sw+jjgnsH9XqcnW85SbTGuI6

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2