Extracted

• • Target

    639135eb69333aba7ecb762072d8bef1d2db83e54edbe627dd223039142b8c91

  • Size

    173KB

  • MD5

    94a7e3859c2e4238421cdfe73d49603c

  • SHA1

    03f03c5b5d8cf362aa52b9e793e7be398d779c21

  • SHA256

    639135eb69333aba7ecb762072d8bef1d2db83e54edbe627dd223039142b8c91

  • SHA512

    74048463606f7017bd8bd3c92773edde5a406247c5ea437b8ee580a3d9e65eb755aa44de466fc2aabef8b9a67c40163afeb3df9bc9fb35f8afe20814d5de85b5

  • SSDEEP

    3072:/Qv8/m8hRr4ZWmhtRGKTCaWzUp0jxrZmHM26XF1g39JZY6Rd:/k83r4MmhvGKTpa1tXUJLd

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2