Extracted

• • Target

    3efcde49be9e18cebc5d95cbf04597be4ee7b95310f691b5e0a3275f77589a8eN.exe

  • Size

    43KB

  • MD5

    8b3bc56d3cb76d2a29e374b10252e190

  • SHA1

    cefb89b9265eb17ec51e5fe052604d37ac4ed7fb

  • SHA256

    3efcde49be9e18cebc5d95cbf04597be4ee7b95310f691b5e0a3275f77589a8e

  • SHA512

    ff331c78ab348ed258b6ad6e1dcd1800aa400dce422b1d7ee531aa48ba6c97af84545db95c58f119fe7ec46644d93c6ec3e48882dd3c64d5ba70d5ec46157a14

  • SSDEEP

    768:F/jqPyqisr4dGirXAHg5rbWOXBDZY9M7Sd/bDXNJb7bTDaSVIV27J:FNqwosBDZY9MKjBJb7bTnVIgJ

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2