xenorat | 02f5ec2c9f965da5fffe6dd8eb42167569caf889aa705b84a7fdbc13fa5a0163[.]exe | Triage

Sharing

General

Target

02f5ec2c9f965da5fffe6dd8eb42167569caf889aa705b84a7fdbc13fa5a0163.exe
Size

261KB
MD5

0dac7d321bdc5c0e2fa4c5ff482d262e
SHA1

84c7dd5e53c785db90a3f409f6d525fa4b88d7e1
SHA256

02f5ec2c9f965da5fffe6dd8eb42167569caf889aa705b84a7fdbc13fa5a0163
SHA512

eee8668630c105b65265c6358f187e97070288da225d345cc86437e60e72fea3b99dc18a3ecef3512b8a1dcce2d879d78d1c11bf4218b6ba188ea667608c0d05
SSDEEP

6144:iJt6fOdmSpMIhgq4ikXUnU6T7Zk1gu8kztNh7urR0xVapC5bC:iJt66mSpMwgnikXUnXT7y1n8Y3harOVq

Score

10^/10

xenorat

Malware Config

Extracted

Family

xenorat

C2

localhost

Mutex

testing 123123

Attributes

delay
1000
install_path
nothingset
port
1234
startup_name
nothingset

Signatures

Detect XenoRat Payload 1 IoCs

resource	yara_rule
sample	family_xenorat

Xenorat family
xenorat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
02f5ec2c9f965da5fffe6dd8eb42167569caf889aa705b84a7fdbc13fa5a0163.exe

Files

02f5ec2c9f965da5fffe6dd8eb42167569caf889aa705b84a7fdbc13fa5a0163.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\MSS\Desktop\xeno-rat-main\xeno rat client\obj\Debug\xeno rat client.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 258KB - Virtual size: 258KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ