Extracted

• • Target

    cres.exe

  • Size

    45KB

  • MD5

    1e7700efbf15f37dd3f86f05c622ae32

  • SHA1

    651957f68d597141fc5325e62189330e05434e74

  • SHA256

    15c2892194da8b7dd9ca72cdec0b3fb3eff422361f603ae2ae17e4be21154928

  • SHA512

    72f1a14b3e20fdf8e9c362cf621b2d1ad04dca4dcaffa0dfd9b3c6e502ed8cd6834194ddeebda74e0d6d38db3ea2102e7ec0bcb6f858df281325e9842e19b11b

  • SSDEEP

    768:pdhO/poiiUcjlJInMC2H9Xqk5nWEZ5SbTDaauI7CPW5H:nw+jjgnt2H9XqcnW85SbT3uIf

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2