Extracted

• • Target

    Bootstrapper Test.exe

  • Size

    50KB

  • MD5

    83a547dd8ce000e555f3eb83cca0bded

  • SHA1

    bf1835cf9f701125846e3397ab7f10fd120cd13f

  • SHA256

    a945f099affe68abe0ba9fd522a0df2787262b97ea5cb5868f9752a00b1c1186

  • SHA512

    d01f505b168a1669931c828b0a86d75401c3c1ef8667a7cba612cb61662592802e8130ac335914e9f02cabd2c63608259cca8fac3cf267ef2404792aeb020bfe

  • SSDEEP

    768:CdhO/poiiUcjlJInLdH9Xqk5nWEZ5SbTDaCWI7CPW5Sspa:kw+jjgnJH9XqcnW85SbTbWIqspa

  Score

  10^/10

  xenoratadwarediscoverypersistenceprivilege_escalationratstealertrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  behavioral1behavioral2