Extracted

• • Target

    548a95874bd76148ec652a03f114709880801c322700821f24349d1950bd94cb.xls

  • Size

    196KB

  • MD5

    e700160268262e4b240c83c431f11299

  • SHA1

    fdea2e1e5f0904c186a53bd325550707f7aa2699

  • SHA256

    548a95874bd76148ec652a03f114709880801c322700821f24349d1950bd94cb

  • SHA512

    2460d16d033021dad30dfa88e547118c05f151070233eb4e39a1e9a8e320fc76b23001f315eb5c3ea18c3f5721c22bfcd9fcae8cca4670ed5ddce5f6da56a0ad

  • SSDEEP

    6144:wxEtjPOtioVjDGUU1qfDlavx+W2QnAj+Ly9ckwDwPq5XlsqYwxNNiprC:E+VkGUqLsqhi4

  Score

  10^/10

  discoveryxenoratmacromacro_on_actionrattrojan

  • Detect XenoRat Payload

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Office macro that triggers on suspicious action

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2