Extracted

• • Target

    BootstrapperNew 1.exe

  • Size

    50KB

  • MD5

    cc3057c5a0ea588db5c15b83cc156b73

  • SHA1

    a66bc3eea3d83174e0bcf76b49dec33370a34a7b

  • SHA256

    d81e265e585f29730061fdb29aceea5e28cb16638b87917bd489f2423ce5ee4f

  • SHA512

    6aaec2fb510e5915379469b7298c9dcf6e39eeabf33b820a70c6bcfd5d5e9a0263490e302048d05e3aeb25f1635ac512b2a66234777ea64058dd85c367329fa9

  • SSDEEP

    768:CdhO/poiiUcjlJInLdH9Xqk5nWEZ5SbTDa5WI7CPW5Sspa:kw+jjgnJH9XqcnW85SbTIWIqspa

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2