General
-
Target
a1af0131970c49bddc6abbf3f2b9225a6c3f7c96bd4c9b6347241415adbfa65c
-
Size
112KB
-
Sample
250209-dz674avqhm
-
MD5
e037e2c2da9d55be7f8043b4ef5db043
-
SHA1
0ac382558b32e8f3c74e308dafbe66a18bafd34a
-
SHA256
a1af0131970c49bddc6abbf3f2b9225a6c3f7c96bd4c9b6347241415adbfa65c
-
SHA512
dfdd945ac1741058101d4d9d864462fa6ec20abf9e37744bbc20d5b07d6b755ba99974adc295d4bab994a78cefb1e4f0f6af994a5cca50efd79832f7e96ef2ed
-
SSDEEP
1536:Tw+jjgnhElmH9XqcnW85SbTOuIapGiSinnYpOd0sP5UGTHTm9DMG5BtT2vbkGW7e:Tw+jqQo91UbTOc
Behavioral task
behavioral1
Sample
a1af0131970c49bddc6abbf3f2b9225a6c3f7c96bd4c9b6347241415adbfa65c.exe
Resource
win7-20241010-en
Malware Config
Extracted
xenorat
192.168.0.7
idspoofer
-
delay
5000
-
install_path
nothingset
-
port
61483
-
startup_name
httpshi
Targets
-
-
Target
a1af0131970c49bddc6abbf3f2b9225a6c3f7c96bd4c9b6347241415adbfa65c
-
Size
112KB
-
MD5
e037e2c2da9d55be7f8043b4ef5db043
-
SHA1
0ac382558b32e8f3c74e308dafbe66a18bafd34a
-
SHA256
a1af0131970c49bddc6abbf3f2b9225a6c3f7c96bd4c9b6347241415adbfa65c
-
SHA512
dfdd945ac1741058101d4d9d864462fa6ec20abf9e37744bbc20d5b07d6b755ba99974adc295d4bab994a78cefb1e4f0f6af994a5cca50efd79832f7e96ef2ed
-
SSDEEP
1536:Tw+jjgnhElmH9XqcnW85SbTOuIapGiSinnYpOd0sP5UGTHTm9DMG5BtT2vbkGW7e:Tw+jqQo91UbTOc
-
Detect XenoRat Payload
-
Xenorat family
-
Downloads MZ/PE file
-