Extracted

• • Target

    173332371539bbdd6c2272bd92dfb169a62201e5625f2b68b0a1fba630c4d3173536315e41874.dat-decoded.exe

  • Size

    45KB

  • MD5

    53b85056b4de3873c6190008dc308229

  • SHA1

    8a9347873074b320d5058f9d62f736965ccbe63e

  • SHA256

    ff250cf343a79c16f77454b1ebe0ecd0e60eb8bc501cfebe0fba1f0433c19f87

  • SHA512

    2b3fff1508b15676e34e1028adbde0a0d72e81148fcfbbbbacdc729877ee2b34a84c5068ac29988f431eca81b8d6194a472ee474c94fdcfca3824f7decb76061

  • SSDEEP

    768:vbdhO/poiiUcjlJInJvH9Xqk5nWEZ5SbTDajWI7CPW5+:vJw+jjgnhH9XqcnW85SbTaWIW

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  behavioral1behavioral2