General

  • Target

    ag.exe

  • Size

    45KB

  • Sample

    241229-r5ddvstpbj

  • MD5

    0a257417be0b566dc344d4f8cfd62ace

  • SHA1

    3cbae1f578344bc133910e30f3ea0b5b6a3017e5

  • SHA256

    0f6272e9838fd19e33cbe0eebb86f7c40d5f05a816714c7b6800f49815ddabd1

  • SHA512

    703e8c9380866cab8c426755ef20801bad96ac200749240a67633a21321c7dddef3d608f384427a7d045de5642d122650ed2050557d00699da731c8a1008f73c

  • SSDEEP

    768:tdhO/poiiUcjlJInUFzH9Xqk5nWEZ5SbTDa5WI7CPW5V:jw+jjgnQH9XqcnW85SbTQWId

Malware Config

Extracted

Family

xenorat

C2

release-adrian.gl.at.ply.gg

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    5000

  • install_path

    nothingset

  • port

    42627

  • startup_name

    nothingset

Targets

    • Target

      ag.exe

    • Size

      45KB

    • MD5

      0a257417be0b566dc344d4f8cfd62ace

    • SHA1

      3cbae1f578344bc133910e30f3ea0b5b6a3017e5

    • SHA256

      0f6272e9838fd19e33cbe0eebb86f7c40d5f05a816714c7b6800f49815ddabd1

    • SHA512

      703e8c9380866cab8c426755ef20801bad96ac200749240a67633a21321c7dddef3d608f384427a7d045de5642d122650ed2050557d00699da731c8a1008f73c

    • SSDEEP

      768:tdhO/poiiUcjlJInUFzH9Xqk5nWEZ5SbTDa5WI7CPW5V:jw+jjgnQH9XqcnW85SbTQWId

    • Detect XenoRat Payload

    • XenorRat

      XenorRat is a remote access trojan written in C#.

    • Xenorat family

MITRE ATT&CK Enterprise v15

Tasks