Extracted

• • Target

    b7af0c5cdc296b96ea5993fed5daa849031c5d1d7b69cb8d445406db1fb1d74b

  • Size

    823KB

  • MD5

    f0da3bdc5e367bec5963e7c88279d549

  • SHA1

    a44f1f9bc3829e8b5317092ab7952cabc38f0366

  • SHA256

    b7af0c5cdc296b96ea5993fed5daa849031c5d1d7b69cb8d445406db1fb1d74b

  • SHA512

    e1137f33a5b52ba52ac9a5a7099422a00db738ebfe130ed9b9ca13cc0cf7e62c68fb189a969a29ab1a50c6bf86b5f2aa085557abfa21f74abf9893645dc9ff33

  • SSDEEP

    24576:RHDP1eovEwCWcDO6j1cV5PaNVNQjUP7JH2ELVj:RHD9PlCnDdj1cVMNVNZ1Xpj

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2