xenorat | CatMain[.]exe | Triage

Sharing

General

Target

CatMain.exe
Size

486KB
MD5

4a9b10328d04e5fe729b70cf32744411
SHA1

4480fb9137c73d4a59de2cac84d697b37fc9010a
SHA256

b7f33253914674d5b8d3a3e09c38b3829ff05799936c8fb60de822a0d1172393
SHA512

7ead97aec26e3ab210221d2cb6421e91e8db747f0da131b12ccf3383e016830f0448b174b14cd1302cebdae4a16d1efc1e0ee3d41f170ceff07f63998a9ae95f
SSDEEP

6144:q+DaDfi52Xml+TJldvpM6wGE6O2eKNafdw0O0oy5HjPxlqjqX25p//fdxW+zQ1E:J+DfzMUfBE6MK0zoyxjPxsdE8Zu

Score

10^/10

xenorat

Malware Config

Signatures

Detect XenoRat Payload 1 IoCs

resource	yara_rule
sample	family_xenorat

Xenorat family
xenorat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CatMain.exe

Files

CatMain.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.v>\
Size: - Virtual size: 500KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.WZb
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sL~
Size: 465KB - Virtual size: 465KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ