Extracted

• • Target

    a40e1563e9bbc7683cc81adcecdf4450817ad2e18ee8534b85714081a500dd65.exe

  • Size

    743KB

  • MD5

    9cf34288dda36ca0b013d6978d1acfe4

  • SHA1

    634560fe79683a2019ee75f669e5bff02c1789f7

  • SHA256

    a40e1563e9bbc7683cc81adcecdf4450817ad2e18ee8534b85714081a500dd65

  • SHA512

    fcf0a8ce71ce9bb1fcba9f14158e8919098dfa75172128bf886bd256216a3b9ef0e44c1ac63177e228fb85522077c8aa1080e2bd415ce29fe341a39dd942f764

  • SSDEEP

    12288:GN2pJlOwXBiPzEhmH5lxgZvvXt+FgqQ8t/6SUoWDGxPlh3i4H9ksxUWv:XrZvPQqqQ8tCSQoh3hxd

  Score

  10^/10

  discoveryxenoratrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2