Extracted

• • Target

    ff645c8b38824fbdfdc8714fc9ff30c170ceca8f5f79b5b6e31ede729b8d7cd9

  • Size

    45KB

  • MD5

    401a617786110ea8ba0923c61b097d76

  • SHA1

    e851ebf5f3355c09a098c36a4c74fbdbf48c3ec3

  • SHA256

    ff645c8b38824fbdfdc8714fc9ff30c170ceca8f5f79b5b6e31ede729b8d7cd9

  • SHA512

    96f2ffe272e67d31e8533697e696be96d3e8c206bc00fb971b5da5e921448592ef38899c672f10514611950dcf132a7b7150dc49ae52319a00041e5822ad63fd

  • SSDEEP

    768:JdhO/poiiUcjlJIn0CLue9H9Xqk5nWEZ5SbTDabWI7CPW5m:Hw+jjgnfye9H9XqcnW85SbTaWIe

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2