Extracted

• • Target

    3d22fbc11a0a5531c00e71c387d5b181.exe

  • Size

    45KB

  • MD5

    3d22fbc11a0a5531c00e71c387d5b181

  • SHA1

    ac0dccbf65b9ecdd419a3f27ed9350374094b430

  • SHA256

    3a0e1b05ff6ec86823873c6e0fa0c85c057ce44a41e9b918bc9273dc2266cdee

  • SHA512

    a9683aacfc05b2465e14626fa12230b3823bded51015d19f8db5b59828df4f6ffe8d47a7d63a2a5971c17288032df681d83c073aceccc0b62fbd2aae3bfa6c3b

  • SSDEEP

    768:edhO/poiiUcjlJInF3EH9Xqk5nWEZ5SbTDaUuI7CPW5V:ow+jjgnREH9XqcnW85SbTBuId

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2