General

  • Target

    02f5ec2c9f965da5fffe6dd8eb42167569caf889aa705b84a7fdbc13fa5a0163.exe

  • Size

    261KB

  • Sample

    250102-aj8jfavjhl

  • MD5

    0dac7d321bdc5c0e2fa4c5ff482d262e

  • SHA1

    84c7dd5e53c785db90a3f409f6d525fa4b88d7e1

  • SHA256

    02f5ec2c9f965da5fffe6dd8eb42167569caf889aa705b84a7fdbc13fa5a0163

  • SHA512

    eee8668630c105b65265c6358f187e97070288da225d345cc86437e60e72fea3b99dc18a3ecef3512b8a1dcce2d879d78d1c11bf4218b6ba188ea667608c0d05

  • SSDEEP

    6144:iJt6fOdmSpMIhgq4ikXUnU6T7Zk1gu8kztNh7urR0xVapC5bC:iJt66mSpMwgnikXUnXT7y1n8Y3harOVq

Malware Config

Extracted

Family

xenorat

C2

localhost

Mutex

testing 123123

Attributes
  • delay

    1000

  • install_path

    nothingset

  • port

    1234

  • startup_name

    nothingset

Targets

    • Target

      02f5ec2c9f965da5fffe6dd8eb42167569caf889aa705b84a7fdbc13fa5a0163.exe

    • Size

      261KB

    • MD5

      0dac7d321bdc5c0e2fa4c5ff482d262e

    • SHA1

      84c7dd5e53c785db90a3f409f6d525fa4b88d7e1

    • SHA256

      02f5ec2c9f965da5fffe6dd8eb42167569caf889aa705b84a7fdbc13fa5a0163

    • SHA512

      eee8668630c105b65265c6358f187e97070288da225d345cc86437e60e72fea3b99dc18a3ecef3512b8a1dcce2d879d78d1c11bf4218b6ba188ea667608c0d05

    • SSDEEP

      6144:iJt6fOdmSpMIhgq4ikXUnU6T7Zk1gu8kztNh7urR0xVapC5bC:iJt66mSpMwgnikXUnXT7y1n8Y3harOVq

    • Detect XenoRat Payload

    • XenorRat

      XenorRat is a remote access trojan written in C#.

    • Xenorat family

MITRE ATT&CK Enterprise v15

Tasks