General

  • Target

    da0b754dcb421abc154a9b341ffe952ec2c046c177937ffe67d0e3914e775e1cN.exe

  • Size

    54KB

  • Sample

    250120-nelqrswngy

  • MD5

    b154eb6e4b4897569bdc63af68f50920

  • SHA1

    8d013e37012aaf3d3aafd942f0c69ea71a409025

  • SHA256

    da0b754dcb421abc154a9b341ffe952ec2c046c177937ffe67d0e3914e775e1c

  • SHA512

    95d45b15456a21102c4ebe19b074d87bda3ddc6e3bd73428bb0ec3d3ed6a4249a67db367d875044f87ac4d401dcd203f78725fdd69140282d7780dcfbc023293

  • SSDEEP

    768:/dhO/poiiUcjlJInvvH9Xqk5nWEZ5SbTDaJWI7CPW5TW/NK+oWP:1w+jjgn3H9XqcnW85SbTAWIi/Y+oa

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    5000

  • install_path

    nothingset

  • port

    4444

  • startup_name

    nothingset

Targets

    • Target

      da0b754dcb421abc154a9b341ffe952ec2c046c177937ffe67d0e3914e775e1cN.exe

    • Size

      54KB

    • MD5

      b154eb6e4b4897569bdc63af68f50920

    • SHA1

      8d013e37012aaf3d3aafd942f0c69ea71a409025

    • SHA256

      da0b754dcb421abc154a9b341ffe952ec2c046c177937ffe67d0e3914e775e1c

    • SHA512

      95d45b15456a21102c4ebe19b074d87bda3ddc6e3bd73428bb0ec3d3ed6a4249a67db367d875044f87ac4d401dcd203f78725fdd69140282d7780dcfbc023293

    • SSDEEP

      768:/dhO/poiiUcjlJInvvH9Xqk5nWEZ5SbTDaJWI7CPW5TW/NK+oWP:1w+jjgn3H9XqcnW85SbTAWIi/Y+oa

    • Detect XenoRat Payload

    • XenorRat

      XenorRat is a remote access trojan written in C#.

    • Xenorat family

MITRE ATT&CK Enterprise v15

Tasks