Extracted

Extracted

• • Target

    64e8a709f1216e3424fcb496c63f54b8a43d3e51948bb807634cf74be30a2428.lnk

  • Size

    2KB

  • MD5

    d860a0bd0c878a590742ccb10f67483b

  • SHA1

    f939c3a41ba4b0910e56a7e89923398525dd0f68

  • SHA256

    64e8a709f1216e3424fcb496c63f54b8a43d3e51948bb807634cf74be30a2428

  • SHA512

    9b6e711503dea81f9b90db103471e3e67708b43065cdbc347726bbd0fd86ade3ff188b017185b7e026cdcabbfe2de75fac3a4fed31a84275a83874000f09c767

  Score

  10^/10

  executionxenoratdiscoverymacromacro_on_actionrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Office macro that triggers on suspicious action

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2