Extracted

• • Target

    48a776e5effacaaee83b198a43a9252d9456fd6f488a8f44af4fd6ee5835d8a9

  • Size

    192KB

  • MD5

    054c7c9df65480b67c1762fdf1071692

  • SHA1

    e9962aa07b013c9d2f56a257f08c3873919c57bf

  • SHA256

    48a776e5effacaaee83b198a43a9252d9456fd6f488a8f44af4fd6ee5835d8a9

  • SHA512

    54403bb19f320a9e7c241ba28f9c0b2b67b9beb8585ab13a9e434a6edf9d4bfbd99047710197f784d685879b6af2929574a5e00347b406dcd2493244b12ac3ad

  • SSDEEP

    3072:PrxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAq3OLFyhxTchWwaZYwP+1oVET5K8lsq/:zxEtjPOtioVjDGUU1qfDlavx+W2QnAqE

  Score

  10^/10

  discoveryxenoratmacromacro_on_actionrattrojan

  • Detect XenoRat Payload

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Office macro that triggers on suspicious action

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2