Extracted

Extracted

• • Target

    ea254e085f81b5d580391f4fab6ce4c462cd66485e7ef42a49f9f12ab158a362.lnk

  • Size

    2KB

  • MD5

    17af012abc0e526f7d02932f5a39d9db

  • SHA1

    5df75915751923ef2ec5226e129b5107ec5ee56a

  • SHA256

    ea254e085f81b5d580391f4fab6ce4c462cd66485e7ef42a49f9f12ab158a362

  • SHA512

    af0fd0d4be8f3db60f122e37d1fe34ff0aeb066205b83aa13c128d0c3c4828651dee9774c9ef0413ae8f3eb65fa62f54054f830ee4aae33a07206086859a5c83

  Score

  10^/10

  executionxenoratdiscoverymacromacro_on_actionrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Office macro that triggers on suspicious action

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2