Extracted

• • Target

    acfgshxdf.exe

  • Size

    174KB

  • MD5

    d0cbf54138d03f82115b5708be94c5c0

  • SHA1

    aeaafe59c0342c0105d764ee69f6292206f661c6

  • SHA256

    c243a7dcd332df7a231b33e346a1db91ad01c7f0a17f10ed8dec3efa34743949

  • SHA512

    fedc40b326466772e5da972798faa3504837ee67cd26f73db2f6a7effae9d1dc511007279ddd3b78b885c8d691c897ffd2a29f82dd37c6a33623eee85ebb1108

  • SSDEEP

    3072:BUjKL04BXtB57iecsOv7lzIAKddLhVcDjgOzzH9P2kYiy3MeKXRPCc96Rd:Bcct1czz+rdLh4jRzH9ukY6eKXRPCnd

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2