General

  • Target

    WaveExecutorInstaller.exe

  • Size

    45KB

  • MD5

    239ec0de5eb6d2337b5c8b22795ae6ed

  • SHA1

    83fee3a7730f9c1e7a5209afab4182cb6d7af8c4

  • SHA256

    efe632eb8a69f68a44f62a10707a30625f1d6e042c563df01c45977c3cc6f429

  • SHA512

    378e8d0a38e3f629395969c81ec570d94ea032d9f08c71a12298513e4a7cccb5c65c6e0088620a319ef1132c91553f966d468fe8bca4d85240ac8afa8e719434

  • SSDEEP

    768:VdhO/poiiUcjlJInxSH9Xqk5nWEZ5SbTDaIuI7CPW5r:rw+jjgnsH9XqcnW85SbT1uIT

Score
10/10

Malware Config

Extracted

Family

xenorat

C2

192.168.1.96

Mutex

WaveExecutor

Attributes
  • delay

    1000

  • install_path

    nothingset

  • port

    52749

  • startup_name

    nothingset

Signatures

  • Detect XenoRat Payload 1 IoCs
  • Xenorat family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • WaveExecutorInstaller.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections