General

  • Target

    WaveExecutorInstaller.exe

  • Size

    45KB

  • Sample

    241230-c1kvtavmhz

  • MD5

    239ec0de5eb6d2337b5c8b22795ae6ed

  • SHA1

    83fee3a7730f9c1e7a5209afab4182cb6d7af8c4

  • SHA256

    efe632eb8a69f68a44f62a10707a30625f1d6e042c563df01c45977c3cc6f429

  • SHA512

    378e8d0a38e3f629395969c81ec570d94ea032d9f08c71a12298513e4a7cccb5c65c6e0088620a319ef1132c91553f966d468fe8bca4d85240ac8afa8e719434

  • SSDEEP

    768:VdhO/poiiUcjlJInxSH9Xqk5nWEZ5SbTDaIuI7CPW5r:rw+jjgnsH9XqcnW85SbT1uIT

Malware Config

Extracted

Family

xenorat

C2

192.168.1.96

Mutex

WaveExecutor

Attributes
  • delay

    1000

  • install_path

    nothingset

  • port

    52749

  • startup_name

    nothingset

Targets

    • Target

      WaveExecutorInstaller.exe

    • Size

      45KB

    • MD5

      239ec0de5eb6d2337b5c8b22795ae6ed

    • SHA1

      83fee3a7730f9c1e7a5209afab4182cb6d7af8c4

    • SHA256

      efe632eb8a69f68a44f62a10707a30625f1d6e042c563df01c45977c3cc6f429

    • SHA512

      378e8d0a38e3f629395969c81ec570d94ea032d9f08c71a12298513e4a7cccb5c65c6e0088620a319ef1132c91553f966d468fe8bca4d85240ac8afa8e719434

    • SSDEEP

      768:VdhO/poiiUcjlJInxSH9Xqk5nWEZ5SbTDaIuI7CPW5r:rw+jjgnsH9XqcnW85SbT1uIT

    • Detect XenoRat Payload

    • XenorRat

      XenorRat is a remote access trojan written in C#.

    • Xenorat family

MITRE ATT&CK Enterprise v15

Tasks