Extracted

• • Target

    GERTGEWSRG.exe

  • Size

    45KB

  • MD5

    a899ac5a3deacb376283e19b5473f0c6

  • SHA1

    0eea6b2835d2eb3bbd047c76bc21929dea157e47

  • SHA256

    05c89adfb97d0bc4b3edb18498844a9ccb013161b8034f2946eddedf44ad9407

  • SHA512

    bc3561e3474087d88abb1ea137b4688550afa93f0046f69af41ccd34e77ac0f10937194e1ad1f6ea44edc30215f1e9fa47b6dce945b944811a74a290702f6208

  • SSDEEP

    768:pdhO/poiiUcjlJIndbqmH9Xqk5nWEZ5SbTDafWI7CPW5x:nw+jjgnNH9XqcnW85SbTuWIp

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2