Overview

overview

10

Static

static

10

vff.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    vff.exe

  • Size

    45KB

  • Sample

    241227-212wrs1phv

  • MD5

    3e857e2fb2793de1f0310d2443088f82

  • SHA1

    582b81e67f23a93c713b68d432432aace74c731a

  • SHA256

    bc6df9c438db5ef373c33b6c6a16a1dfa70f2d8c66a8352ea1632579225edc76

  • SHA512

    4cf910b7fa9bd39ffaab40789c0f896f26f41b5004f0d4434deb50453131a930998a87a8bc2e0383d3dd982fa473f14ff228cff5bbd46cc1a0d0cf79fb97ffbc

  • SSDEEP

    768:RdhO/poiiUcjlJInGTwH9Xqk5nWEZ5SbTDa6WI7CPW5p:Pw+jjgnLH9XqcnW85SbTTWIR

Score
10/10
xenoratdiscoveryrattrojan

Malware Config

Extracted

Family

xenorat

C2

agreement-lists.gl.at.ply.gg

Mutex

skibdiitoilet!zzz

Attributes
  • delay

    5000

  • install_path

    nothingset

  • port

    48889

  • startup_name

    nothingset

Targets

    • Target

      vff.exe

    • Size

      45KB

    • MD5

      3e857e2fb2793de1f0310d2443088f82

    • SHA1

      582b81e67f23a93c713b68d432432aace74c731a

    • SHA256

      bc6df9c438db5ef373c33b6c6a16a1dfa70f2d8c66a8352ea1632579225edc76

    • SHA512

      4cf910b7fa9bd39ffaab40789c0f896f26f41b5004f0d4434deb50453131a930998a87a8bc2e0383d3dd982fa473f14ff228cff5bbd46cc1a0d0cf79fb97ffbc

    • SSDEEP

      768:RdhO/poiiUcjlJInGTwH9Xqk5nWEZ5SbTDa6WI7CPW5p:Pw+jjgnLH9XqcnW85SbTTWIR

    Score
    10/10
    xenoratdiscoveryrattrojan

    • Detect XenoRat Payload

    • XenorRat

      XenorRat is a remote access trojan written in C#.

      trojanratxenorat

    • Xenorat family

      xenorat
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks