Extracted

• • Target

    Xeno.exe

  • Size

    62KB

  • MD5

    25f0b9cbe7919ff503407c6ef58d1cbd

  • SHA1

    d7421c3eceacdeed5db5de0f047afe40d21ff145

  • SHA256

    16136678f701be73ebaf5b08fa6c1eaf09e207bbdb3a8edd4d5a81ecb0c2387b

  • SHA512

    bff8175621fa9204af6c78cb533d82a4c644550978cb3bcae8998ca5a65c0a5a4261096900c2d162ec28018e332f3ebebabeb86e3e5bb08782b2d78fed58d804

  • SSDEEP

    768:1dhM/poiiUcjlJIn9mL9Xqk5nWEZ5SbTDaiNI7CPW5X:L2+jjgnoL9XqcnW85SbTTNI/

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2