Extracted

• • Target

    7ab4cff638814f6af02b404eb9be4546122f56f93b071c44728d79f71e074277.vbs

  • Size

    10KB

  • MD5

    49c83d8e10443183f49df571416c685b

  • SHA1

    01df897fe262f4aaf0b3d48ccade34587dd83e72

  • SHA256

    7ab4cff638814f6af02b404eb9be4546122f56f93b071c44728d79f71e074277

  • SHA512

    92812130a270b977e5d0c655731b808a4c2d01a67d720921de1072d553199a2c200aa34853bda5937219e90c813f0a3350e59f0072a37c38c8de09a1adba7d49

  • SSDEEP

    192:PQrn65rH/Jjw5jvacpYTvS96XVELDrRiHgk:PQGrHdmvib1yLR/k

  Score

  10^/10

  xenoratdiscoverymacromacro_on_actionrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Office macro that triggers on suspicious action

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2