Extracted

• • Target

    bf6659af111dfa8daca20d98f53711b282cce11434fff5d245a0c277e6c806ef.vbs

  • Size

    10KB

  • MD5

    0995c2673a7fe289c96c2bab2ac7dfb4

  • SHA1

    5e78f526dc678b118650746f4f1c2f8d782a0242

  • SHA256

    bf6659af111dfa8daca20d98f53711b282cce11434fff5d245a0c277e6c806ef

  • SHA512

    53e29b747ad1c100f389a38c720280160f01421938277bd84b844fd94fec2d897ac1172b6b8c7335797f00f72cce90a7e7e9557962a9192947e9c7078eadd789

  • SSDEEP

    192:dBwtLFm2jh5HdWo6uUcnzRs1JARdGgG7A:dBAr6X8kJeGA

  Score

  10^/10

  xenoratdiscoverymacromacro_on_actionrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Office macro that triggers on suspicious action

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2