Extracted

• • Target

    extracted_payload.exe.bin.exe

  • Size

    204KB

  • MD5

    d45f2292784bc9e8a19d093e9950673f

  • SHA1

    7c4e46b465680ef32ff55fc17916a5f4f6f9dbd5

  • SHA256

    a2763124af5630502ace78bd406f0ff15ba6701b29fe38a6a3d60c1e65e9ce73

  • SHA512

    a14cbac8377689b06c126c3ee71cc79c8b06e1650ecf0d29c7963425d1842dafb0fd6e1a66df1411cec487f6dcc5b696ee3d7a3f623773be61fd0b7a96646989

  • SSDEEP

    3072:BhRxII30n0gihoSUgmGoQkrCMOsiDnwKH5OD1shB8t7ARD:nD0nxiWSUgPk5iD5BXR

  Score

  10^/10

  xenoratdiscoveryevasionratthemidatrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2