Extracted

• • Target

    Steam.exe

  • Size

    5.9MB

  • MD5

    83df4320406c8a4d6a77f47f694d3489

  • SHA1

    01e3d49eeec578e954724608f8000463c939ed1a

  • SHA256

    a1c193a12ee68ca56f0286ef3b9a221198603e13b0bb207a0554e79de927a951

  • SHA512

    d34a01373453ad0e69203ad5f288141cbe514986704eaf388d3d61f50aa75056dc5c16f1cbe0ca0de553d462bed3dc558e9141164e7476a4d83791f886016b61

  • SSDEEP

    98304:piEwNGSuhSSjEUE14A3CQTC2tNf+gfdUPYk4OpurnepaphA0FqxzXYTNOJSXRTzE:pINHcjQ+Y3NGgfdUcrn4arOzI5RvgH

  Score

  10^/10

  xenoratdiscoveryrattrojanvmprotect

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2