Extracted

• • Target

    Sigmanly_eb9dc118872152800b1bc901fee1162be82ccb6772e0a1706b56fed261255037

  • Size

    45KB

  • MD5

    1a82ebd26769009cfa116d6c722d7af2

  • SHA1

    dfbeb5e3a3e83ae8daaf388f4ef6de430f6e0fa6

  • SHA256

    eb9dc118872152800b1bc901fee1162be82ccb6772e0a1706b56fed261255037

  • SHA512

    940e9ebfca92940f6e471a3001ddd958aef933178b29f424f9d4c1e2f964915ae1369e6c690cb6024e92b8e5b5de51b98b74f762365f91fdce3b38e4204dd65f

  • SSDEEP

    768:SdhO/poiiUcjlJIn/lH9Xqk5nWEZ5SbTDabWI7CPW5h:0w+jjgn9H9XqcnW85SbTSWI5

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2