Overview

overview

10

Static

static

10

serrteter.exe

windows7-x64

10

serrteter.exe

windows10-2004-x64

10

serrteter.exe

android-10-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    serrteter.exe

  • Size

    45KB

  • Sample

    241218-vy523sxker

  • MD5

    369a6ea15eb8ebde64fc1e043ad44382

  • SHA1

    7f45dbf3268ec3bbfdd06c2086294b26d9beebac

  • SHA256

    b543df56136a5f5cab011ce1d88dd866aa47578c37bf5edab19db2c3d8c4e771

  • SHA512

    d88c224419abefae5da3ea3cb4b479c1bd1063a70ad3659d138886e194aca5a82e124e6dc74e108501fbbb0cdcd58c0bf9f8b53330e00a7bc74e978f1ac58533

  • SSDEEP

    768:FdhO/poiiUcjlJInazH9Xqk5nWEZ5SbTDa+WI7CPW5N:bw+jjgnYH9XqcnW85SbTPWIF

Score
10/10
xenoratandroiddiscoveryrattrojan

Malware Config

Extracted

Family

xenorat

C2

0.0.0.0

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    1

  • install_path

    appdata

  • port

    8888

  • startup_name

    Windows

Targets

    • Target

      serrteter.exe

    • Size

      45KB

    • MD5

      369a6ea15eb8ebde64fc1e043ad44382

    • SHA1

      7f45dbf3268ec3bbfdd06c2086294b26d9beebac

    • SHA256

      b543df56136a5f5cab011ce1d88dd866aa47578c37bf5edab19db2c3d8c4e771

    • SHA512

      d88c224419abefae5da3ea3cb4b479c1bd1063a70ad3659d138886e194aca5a82e124e6dc74e108501fbbb0cdcd58c0bf9f8b53330e00a7bc74e978f1ac58533

    • SSDEEP

      768:FdhO/poiiUcjlJInazH9Xqk5nWEZ5SbTDa+WI7CPW5N:bw+jjgnYH9XqcnW85SbTPWIF

    Score
    10/10
    xenoratdiscoveryrattrojan

    • Detect XenoRat Payload

    • XenorRat

      XenorRat is a remote access trojan written in C#.

      trojanratxenorat

    • Xenorat family

      xenorat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Tasks