Extracted

• • Target

    DurableLauncher.exe

  • Size

    10.5MB

  • MD5

    3980d879e8cdab01a8c85a98863c2064

  • SHA1

    65196c9bb57059f3b8f1f23e2a8f9204051a6473

  • SHA256

    1877f5f99c834df6605e2fd22460fa93ce03b87d50e47ba7cb274d856257a159

  • SHA512

    ebf991a2e495804c3414e6b70a0720253edd7a8c717a2d57ebcf099814b66b6717a03f4b207cb27701cd5d1415ccac3bd7c6bf0313c733713adae23dead4719f

  • SSDEEP

    196608:H0jNSwsCQcSDUhj7237EAMJoOA394I1hKJgYkMAhfpww5vlb2wBsY:yowsCKohf2LEAZO5I1GgYkZ19b/iY

  Score

  10^/10

  xenoratdiscoveryexecutionrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1