Extracted

• • Target

    ec6627e48bb4c56abbb2a4563072e631.doc

  • Size

    191KB

  • MD5

    ec6627e48bb4c56abbb2a4563072e631

  • SHA1

    9e237643473c67940eb359bba09825114c7bc726

  • SHA256

    548212f42d5dc4965db354d6ce075422dcb3331a213fb0b5b662e08e59234829

  • SHA512

    4fb47dcf9e0fe13e038a88cc8c9e06ff1dde996d69281c505a07c3d4cc591e32770c1df8dac3da8d031f4868073ebde8202a7173dfd369b016aa2c69af2385a3

  • SSDEEP

    3072:Q877VGZ5Sd3b4e0wNZtsqXNKd5AvDJW4S+I/tZ6X1bpF6m+3b:9GZYwAZHMCDJ8/u5pAm0b

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2