Extracted

• • Target

    svchost.exe.bin.exe

  • Size

    3.9MB

  • MD5

    9ce8e0cbb54f24de304851e0b7226c0a

  • SHA1

    1db4c3d746ea0ad15e98ed3a2b96c2ca09fb1366

  • SHA256

    59cd7e7b0c1c0760cb9499775184b02d8a8e3188bacd9420b04987b0b5724eb5

  • SHA512

    fe5fd7e0f40074e45ad5a1709ff72670d47c2cb5e383cc9f6f4baccb21374a334d2ca1d970534f8815ae9a68c1e1f27b6517e3f8eb0a365b390686d61d0e97f8

  • SSDEEP

    98304:xIQjojuFS4tTWv+uwCu48dIrvmnpE4h5CG4DdtED/:2KsovGIL5eG+C/

  Score

  10^/10

  xenoratdiscoveryevasionratthemidatrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2