Overview

overview

10

Static

static

10

3672-24-0x...ry.exe

windows7-x64

3672-24-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3672-24-0x0000000000400000-0x0000000000412000-memory.dmp

  • Size

    72KB

  • MD5

    8a182bcd7d6fcbebaf1430ea7f26f2cb

  • SHA1

    b1dc894d79532235118b5fd82c5dbd946655c05c

  • SHA256

    d85b71a760ddd43c322612380ca7029bc7b41eecb904ce1a24f64787481c3f98

  • SHA512

    678bb31205a0fca5a2162b6e2f78f444f38a96b3867bf72c8955639f3015f63d6f353f58e6bfd4e292a257969f55fc2006ff54da1d4cf9742d4393c8bf7fc010

  • SSDEEP

    768:FdhO/poiiUcjlJIn9hYH9Xqk5nWEZ5SbTDa6uI7CPW5H:bw+jjgn9SH9XqcnW85SbT/uI/

Score
10/10
xenorat

Malware Config

Extracted

Family

xenorat

C2

failed2.myftp.org

Mutex

Winsock2Mutex

Attributes
  • delay

    5000

  • install_path

    appdata

  • port

    4782

  • startup_name

    start.exe

Signatures

  • Detect XenoRat Payload 1 IoCs
  • Xenorat family
    xenorat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 3672-24-0x0000000000400000-0x0000000000412000-memory.dmp
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections