Extracted

• • Target

    setup.exe

  • Size

    45KB

  • MD5

    55015058afbda7560bc25995cd7d18a2

  • SHA1

    d48e832259ac210da5529b9074976e3c32d84098

  • SHA256

    e4d2d76d8151f045a9229cc69920b48284539abd9b4b0bb039b680b76f9412a4

  • SHA512

    7d9e7a610434d3ae09da8f831c88d4a328426ecd21d4d44cfb0430304c0232ef5da5d79faa9870d1ba7977fbd2a5a1ff450200fe98b735902738db11ca662650

  • SSDEEP

    768:5dhO/poiiUcjlJInX3H9Xqk5nWEZ5SbTDa2uI7CPW5i:3w+jjgnnH9XqcnW85SbT7uIK

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2