Extracted

• • Target

    21b7b8656a008ad3e5df1725cddf55e650812c1f3d59609f14c0d3089a886de6

  • Size

    166KB

  • MD5

    f44302503ea4eedfa831c25711df51b7

  • SHA1

    127d6ec83904de48d90c293e53c905fc4206bfb8

  • SHA256

    21b7b8656a008ad3e5df1725cddf55e650812c1f3d59609f14c0d3089a886de6

  • SHA512

    71e9512244d864b53abf436b496a53e6771135cc7d5fc0e4df7d04ac23074b6ed1e7438a28bc232a70f57de97367f0e3a21925bed738c5e47bdf3487ab2f4e03

  • SSDEEP

    3072:XdkwdXAqPEHTJJuVqhHjFV2xEEbh9pKP2qYCp65nTGsAeXy0fkd:XmwBAQeVmWHHePH02qYCp6NGsAeXy9d

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2