Extracted

• • Target

    6fb46f2f43c2cca4250c3acf5254b827.exe

  • Size

    211KB

  • MD5

    6fb46f2f43c2cca4250c3acf5254b827

  • SHA1

    8967e19260d8638a0afb7171d917ad7b70df0900

  • SHA256

    7cc5e330c3c53f76341b2901bb1f48a32a0d0b4a897d1bc33925270696f40bce

  • SHA512

    24565194f406feb006e53905523ab6193f244ee627f9c5b5c98459018cef9213cb9566d269e98f30bb1c93fa34e339c8deca96ff76be14ad37b6398e96bc1502

  • SSDEEP

    3072:Ew+jqFlFfG91UbT7CgZGWJk5ArMtnoLTL8k8xhX:NWmG91UbSg8WJkxWL8N

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2