Extracted

• • Target
    a4fec84817659fd95a1cfca90d750f64da249942cb660fb735f76e6d66fd7c68.exe
  • Size 174KB
  • SHA256 a4fec84817659fd95a1cfca90d750f64da249942cb660fb735f76e6d66fd7c68
  • MD5 738ce05fd101df895a9f94194c780b9f
  • SHA1 08515188d79a00dcfe46d2fd3aabe507a5da32c0
  • SHA512 9d3b15a340445220b994070efae6a9b3b08dfdcbc3926eacacd251c7cefab436ed100853487f8cf8f52a4d1fd382efd73391ca6894d4c0f7b38397c8208202ab
  • SSDEEP 3072:BUjKL04BXtB57iecsOv7lzIAKddLhVcDjgOzzH9P2kYiy3MeKXRPCc96Rd/:Bcct1czz+rdLh4jRzH9ukY6eKXRPCnd/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2