Extracted

• • Target
    test.exe
  • Size 4.5MB
  • SHA256 b67d8fc52334fb2309368bf2a738520f1b42436951b211b7896f612b86350c10
  • MD5 ec79983fdb605310fac832ba5809e2d6
  • SHA1 ca83d6453563e02decf614d0ce331de493267d2f
  • SHA512 234bb8696c8a6929784165366dc4317d5826738711a7661bf26e4ffab8e958db23d0f2a11542b3f0b5c4c71d62d3e4bc7a730d94d917a21d132d40e2a67ed460
  • SSDEEP 98304:ePj50PrsilC2IbhblAh5+dWspirADIsYAVjw1gI:i5gahZWs80sfsw1R
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xenoratdefense_evasiondiscoveryexecutionrattrojanxmrigminerpersistenceupx

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Stops running service(s)

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2