Extracted

• • Target

    a4fec84817659fd95a1cfca90d750f64da249942cb660fb735f76e6d66fd7c68.exe

  • Size

    174KB

  • MD5

    738ce05fd101df895a9f94194c780b9f

  • SHA1

    08515188d79a00dcfe46d2fd3aabe507a5da32c0

  • SHA256

    a4fec84817659fd95a1cfca90d750f64da249942cb660fb735f76e6d66fd7c68

  • SHA512

    9d3b15a340445220b994070efae6a9b3b08dfdcbc3926eacacd251c7cefab436ed100853487f8cf8f52a4d1fd382efd73391ca6894d4c0f7b38397c8208202ab

  • SSDEEP

    3072:BUjKL04BXtB57iecsOv7lzIAKddLhVcDjgOzzH9P2kYiy3MeKXRPCc96Rd/:Bcct1czz+rdLh4jRzH9ukY6eKXRPCnd/

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2