Extracted

Extracted

• • Target
    ea254e085f81b5d580391f4fab6ce4c462cd66485e7ef42a49f9f12ab158a362.lnk
  • Size 2KB
  • SHA256 ea254e085f81b5d580391f4fab6ce4c462cd66485e7ef42a49f9f12ab158a362
  • MD5 17af012abc0e526f7d02932f5a39d9db
  • SHA1 5df75915751923ef2ec5226e129b5107ec5ee56a
  • SHA512 af0fd0d4be8f3db60f122e37d1fe34ff0aeb066205b83aa13c128d0c3c4828651dee9774c9ef0413ae8f3eb65fa62f54054f830ee4aae33a07206086859a5c83
  • MD5 SHA1 SHA512

  Score

  10^/10

  executionxenoratdiscoverymacromacro_on_actionrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Office macro that triggers on suspicious action

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2