General
-
Target
M90ML_Efispoofer.exe
-
Size
45KB
-
Sample
250105-rgtqyawnbx
-
MD5
d243bb6440d8a27c86e9e3a3b14261f0
-
SHA1
0be4a0a10d0f882d12bc943c7e3fbe3bb85cd34c
-
SHA256
9f5fc80c61b163a400acb871ecd08865a07ea9869cfd33845f4450a219779964
-
SHA512
7b5775134e234955a825cf8ee85e608e4ada7282afccc9304afb7dcd305100f927ed051c405db393395c6fd7e661632b6a7e5d03bd787679f176884b13a632ed
-
SSDEEP
768:tdhO/poiiUcjlJInWYH9Xqk5nWEZ5SbTDalYuI7CPW57:jw+jjgnjH9XqcnW85SbTPuIz
Behavioral task
behavioral1
Sample
M90ML_Efispoofer.exe
Resource
win7-20240903-en
Malware Config
Extracted
xenorat
128.78.132.78
Xeno_rat_nd8912d
-
delay
5000
-
install_path
nothingset
-
port
4444
-
startup_name
Efi spoofer auto spoof
Targets
-
-
Target
M90ML_Efispoofer.exe
-
Size
45KB
-
MD5
d243bb6440d8a27c86e9e3a3b14261f0
-
SHA1
0be4a0a10d0f882d12bc943c7e3fbe3bb85cd34c
-
SHA256
9f5fc80c61b163a400acb871ecd08865a07ea9869cfd33845f4450a219779964
-
SHA512
7b5775134e234955a825cf8ee85e608e4ada7282afccc9304afb7dcd305100f927ed051c405db393395c6fd7e661632b6a7e5d03bd787679f176884b13a632ed
-
SSDEEP
768:tdhO/poiiUcjlJInWYH9Xqk5nWEZ5SbTDalYuI7CPW57:jw+jjgnjH9XqcnW85SbTPuIz
-
Detect XenoRat Payload
-
Xenorat family
-