General

  • Target

    8b6c03b7776bf3d06daad5b495a7654c91b9bb7511d4ec67f6ed886dc0890419N.exe

  • Size

    261KB

  • Sample

    250102-klkv9swpdn

  • MD5

    891659f7f6e1165c1e603526b14f8c30

  • SHA1

    1a7e0e9fddc90ff2cce7fa3147a9ae13fe2b5287

  • SHA256

    8b6c03b7776bf3d06daad5b495a7654c91b9bb7511d4ec67f6ed886dc0890419

  • SHA512

    db98e9da975da473b12269174ba9a562a3581e5da1cdf2b6f5b823901d8fe69febaa918153a4e5fefcde4ed63598d6c8a2c98c5ad2697dc640cf151288480195

  • SSDEEP

    6144:iJt6fOdmSpMIhgq4ikXUnU6T7Zk1gu8kztNh7urR0xVapC5b:iJt66mSpMwgnikXUnXT7y1n8Y3harOVI

Malware Config

Extracted

Family

xenorat

C2

localhost

Mutex

testing 123123

Attributes
  • delay

    1000

  • install_path

    nothingset

  • port

    1234

  • startup_name

    nothingset

Targets

    • Target

      8b6c03b7776bf3d06daad5b495a7654c91b9bb7511d4ec67f6ed886dc0890419N.exe

    • Size

      261KB

    • MD5

      891659f7f6e1165c1e603526b14f8c30

    • SHA1

      1a7e0e9fddc90ff2cce7fa3147a9ae13fe2b5287

    • SHA256

      8b6c03b7776bf3d06daad5b495a7654c91b9bb7511d4ec67f6ed886dc0890419

    • SHA512

      db98e9da975da473b12269174ba9a562a3581e5da1cdf2b6f5b823901d8fe69febaa918153a4e5fefcde4ed63598d6c8a2c98c5ad2697dc640cf151288480195

    • SSDEEP

      6144:iJt6fOdmSpMIhgq4ikXUnU6T7Zk1gu8kztNh7urR0xVapC5b:iJt66mSpMwgnikXUnXT7y1n8Y3harOVI

    • Detect XenoRat Payload

    • XenorRat

      XenorRat is a remote access trojan written in C#.

    • Xenorat family

MITRE ATT&CK Enterprise v15

Tasks