Overview

overview

10

Static

static

1

888 Rat V1.2.6.7z

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    888 Rat V1.2.6.7z.001

  • Size

    10.0MB

  • Sample

    250110-xlc7mssnf1

  • MD5

    70c160ab99eabbfc10ea4674dfff4ebf

  • SHA1

    1fa3621a2cfa9107bf284bdc5a4f38c110eb514b

  • SHA256

    a7d26a000e45ebfdb779424adae211587b7759185ca8fd535975c4ddf2ec26d4

  • SHA512

    dfd33fe5c91f997ca1d2782a901669655fa1141b93697a04288dae61ba4c9971198548e1cf2ed4d2d29d1f561d9195f28319d1bd0cdb5c0a067a5d70c240d20f

  • SSDEEP

    196608:b8KR3Q2Ye5FPqRXivw+nlaHEozN4QL/GWaHjnnAqG1e0BRpISL2gCw:b8KmCFPqRS0Eox4QLOV0eyIY2gl

Score
10/10
xenoratdiscoveryrattrojan

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    5000

  • install_path

    appdata

  • port

    4444

  • startup_name

    WindowsSys64

Targets

    • Target

      888 Rat V1.2.6.7z.001

    • Size

      10.0MB

    • MD5

      70c160ab99eabbfc10ea4674dfff4ebf

    • SHA1

      1fa3621a2cfa9107bf284bdc5a4f38c110eb514b

    • SHA256

      a7d26a000e45ebfdb779424adae211587b7759185ca8fd535975c4ddf2ec26d4

    • SHA512

      dfd33fe5c91f997ca1d2782a901669655fa1141b93697a04288dae61ba4c9971198548e1cf2ed4d2d29d1f561d9195f28319d1bd0cdb5c0a067a5d70c240d20f

    • SSDEEP

      196608:b8KR3Q2Ye5FPqRXivw+nlaHEozN4QL/GWaHjnnAqG1e0BRpISL2gCw:b8KmCFPqRS0Eox4QLOV0eyIY2gl

    Score
    10/10
    xenoratdiscoveryrattrojan

    • Detect XenoRat Payload

    • XenorRat

      XenorRat is a remote access trojan written in C#.

      trojanratxenorat

    • Xenorat family

      xenorat

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks