Extracted

Extracted

• • Target

    4a6695307864dfe0b2e8b516afce79959cb20fed28734d5426450091367255a4.lnk

  • Size

    2KB

  • MD5

    5f82d730794323e47df2c5361e13ce69

  • SHA1

    e05dba2157cec9966790f75cba9899243939b569

  • SHA256

    4a6695307864dfe0b2e8b516afce79959cb20fed28734d5426450091367255a4

  • SHA512

    9b0ffcccaff5071944b6525bcb9678aed94f939700c741ebc99f919cdc4033d86a79546f39080e1991b41cd7cf2e243d434b147764495b3548e1f563a1a0ea07

  Score

  10^/10

  executionxenoratdiscoverymacromacro_on_actionrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Office macro that triggers on suspicious action

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2