xenorat | 8b6c03b7776bf3d06daad5b495a7654c91b9bb7511d4ec67f6ed886dc0890419N[.]exe | Triage

Sharing

General

Target

8b6c03b7776bf3d06daad5b495a7654c91b9bb7511d4ec67f6ed886dc0890419N.exe
Size

261KB
MD5

891659f7f6e1165c1e603526b14f8c30
SHA1

1a7e0e9fddc90ff2cce7fa3147a9ae13fe2b5287
SHA256

8b6c03b7776bf3d06daad5b495a7654c91b9bb7511d4ec67f6ed886dc0890419
SHA512

db98e9da975da473b12269174ba9a562a3581e5da1cdf2b6f5b823901d8fe69febaa918153a4e5fefcde4ed63598d6c8a2c98c5ad2697dc640cf151288480195
SSDEEP

6144:iJt6fOdmSpMIhgq4ikXUnU6T7Zk1gu8kztNh7urR0xVapC5b:iJt66mSpMwgnikXUnXT7y1n8Y3harOVI

Score

10^/10

xenorat

Malware Config

Extracted

Family

xenorat

C2

localhost

Mutex

testing 123123

Attributes

delay
1000
install_path
nothingset
port
1234
startup_name
nothingset

Signatures

Detect XenoRat Payload 1 IoCs

resource	yara_rule
sample	family_xenorat

Xenorat family
xenorat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8b6c03b7776bf3d06daad5b495a7654c91b9bb7511d4ec67f6ed886dc0890419N.exe

Files

8b6c03b7776bf3d06daad5b495a7654c91b9bb7511d4ec67f6ed886dc0890419N.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\MSS\Desktop\xeno-rat-main\xeno rat client\obj\Debug\xeno rat client.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 258KB - Virtual size: 258KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ