xenorat | 3d22fbc11a0a5531c00e71c387d5b181[.]exe | Triage

Sharing

General

Target

3d22fbc11a0a5531c00e71c387d5b181.exe
Size

45KB
MD5

3d22fbc11a0a5531c00e71c387d5b181
SHA1

ac0dccbf65b9ecdd419a3f27ed9350374094b430
SHA256

3a0e1b05ff6ec86823873c6e0fa0c85c057ce44a41e9b918bc9273dc2266cdee
SHA512

a9683aacfc05b2465e14626fa12230b3823bded51015d19f8db5b59828df4f6ffe8d47a7d63a2a5971c17288032df681d83c073aceccc0b62fbd2aae3bfa6c3b
SSDEEP

768:edhO/poiiUcjlJInF3EH9Xqk5nWEZ5SbTDaUuI7CPW5V:ow+jjgnREH9XqcnW85SbTBuId

Score

10^/10

xenorat

Malware Config

Extracted

Family

xenorat

C2

139.99.86.21

Mutex

Xeno_rat_nd8912d

Attributes

delay
5000
install_path
appdata
port
2003
startup_name
nothingset

Signatures

Detect XenoRat Payload 1 IoCs

resource	yara_rule
sample	family_xenorat

Xenorat family
xenorat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3d22fbc11a0a5531c00e71c387d5b181.exe

Files

3d22fbc11a0a5531c00e71c387d5b181.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ