xenorat | xeno rat client[.]exe | Triage

Sharing

General

Target

xeno rat client.exe
Size

46KB
MD5

0357dfb1dfb7ec98fe2f7a88f75fbd17
SHA1

78fcc4a5df49947cd24d03ccbdc3af12891add10
SHA256

03c3e1e4c32e9fb2667ef822a88eb6f843eb31878a22e248fd491c335453c45d
SHA512

15491ff405cd9cdf93bfaef0a3bef426dc3e7d60898c2be8c305973dc56e47c57a715f8984fb6ef3de4c3a164e9d18d5e3f3d87f94a9f19e40c53a4edd86ddaf
SSDEEP

768:6dqf0GXKojwYybbZWsiBHUuOC+iQKb9km3X9Z5SbTDapFt24:64R0z3ZWsiBHUup/9kmj5SbTcFb

Score

10^/10

xenorat

Malware Config

Extracted

Family

xenorat

C2

localhost

Mutex

testing 123123

Attributes

delay
1000
install_path
nothingset
port
1234
startup_name
nothingset

Signatures

Detect XenoRat Payload 1 IoCs

resource	yara_rule
sample	family_xenorat

Xenorat family
xenorat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
xeno rat client.exe

Files

xeno rat client.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\ookse\Desktop\xeno-rat-main\xeno rat client\obj\Release\xeno rat client.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ