Extracted

• • Target

    195928ce3054739020a7985c9ac1d652382da4df5dbfab8b46979a07989b16c7.vbs

  • Size

    10KB

  • MD5

    045d8d61f86f0d65f12f5c86c5ae2239

  • SHA1

    24d19c6daf69f931cf0d87400057ba48ac720c73

  • SHA256

    195928ce3054739020a7985c9ac1d652382da4df5dbfab8b46979a07989b16c7

  • SHA512

    5709553a258cfb3ea4a355513a8217a539360e79f0db852d5639d327bf02a2901ac8955ecb2633be3d955cdecaf94e7ed949a9d165f87e734a82c9605c920cbf

  • SSDEEP

    96:PXVr+kLYdhQg41LcGo5z05lj1iJYaaWK15xgIl5oR8y70zPwP9j9py1evpMr0sIC:PlVg4aUiyPxhoR8y7AOFA0sIogiXIW

  Score

  10^/10

  xenoratdiscoverymacromacro_on_actionrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Office macro that triggers on suspicious action

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2