Extracted

• • Target

    e629bbd6a5b5c253f38cea38d156d81e0f0e391b7e7618ff275e31fa0d3a34c6.doc

  • Size

    35KB

  • MD5

    df7222411a3a5c18e0d8fb28befb5ed7

  • SHA1

    3680092dcd1918b0f0d11c9d2500db6c161956cb

  • SHA256

    e629bbd6a5b5c253f38cea38d156d81e0f0e391b7e7618ff275e31fa0d3a34c6

  • SHA512

    794d3f34297d17cc9d078a70489705b45f4b885619879ef2cba4d04498ba198680013a742b9d691b88307f24eb61a065fce4827cf138f2ef7504724cd4dc4cc7

  • SSDEEP

    384:wopiSY5UPeL/kyht18/HsowbyD5yQjc60jlj9yD5yQjsyp/d7ryYx:F7C7+BfM4Br

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2