Extracted

Extracted

• • Target

    05692e7735450069cc9e0c78bb80514c312d40ef47efbbbaae701a624fbabfba.lnk

  • Size

    2KB

  • MD5

    cfd668a55ea2ee344f5a9badb6ff18b7

  • SHA1

    b3927747076a408a9e73afa0df3a6adadcbae950

  • SHA256

    05692e7735450069cc9e0c78bb80514c312d40ef47efbbbaae701a624fbabfba

  • SHA512

    e8976004a15afced95af6a14e0c8360be13014dffdcac71aff24964036318b9cec958ce87db71dfec79f88944367ed7c6beb0b6ba8187f7329d44b55fc3fa943

  Score

  10^/10

  executionxenoratdiscoverymacromacro_on_actionrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Office macro that triggers on suspicious action

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2