Overview

overview

10

Static

static

10

BootstrapperNew 1.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BootstrapperNew 1.exe

  • Size

    50KB

  • Sample

    250216-tn93lsskhl

  • MD5

    1eff35c8530e3775e44c9f7096ebcda0

  • SHA1

    41b00fb6bb5d0cece18910d3789f6a70b5eb1906

  • SHA256

    15b6b5588bca8c558900e44092cb741a872974e33ccb8547618cad751e464b9c

  • SHA512

    7ae7b6e09b8afba8b27fa4db75c100659ef1e671c11b877067763ebf352f3a05404c71e587727e3cd15f68acaf539da4328f6785e4c28646e8e490c4c98903e0

  • SSDEEP

    768:qdhO/poiiUcjlJIn3dH9Xqk5nWEZ5SbTDa5WI7CPW5ispY:Mw+jjgntH9XqcnW85SbTIWIqspY

Score
10/10
xenoratdiscoveryrattrojan

Malware Config

Extracted

Family

xenorat

C2

192.168.1.236

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    4785

  • install_path

    appdata

  • port

    1194

  • startup_name

    Solara Bootstrapper Dependinces

Targets

    • Target

      BootstrapperNew 1.exe

    • Size

      50KB

    • MD5

      1eff35c8530e3775e44c9f7096ebcda0

    • SHA1

      41b00fb6bb5d0cece18910d3789f6a70b5eb1906

    • SHA256

      15b6b5588bca8c558900e44092cb741a872974e33ccb8547618cad751e464b9c

    • SHA512

      7ae7b6e09b8afba8b27fa4db75c100659ef1e671c11b877067763ebf352f3a05404c71e587727e3cd15f68acaf539da4328f6785e4c28646e8e490c4c98903e0

    • SSDEEP

      768:qdhO/poiiUcjlJIn3dH9Xqk5nWEZ5SbTDa5WI7CPW5ispY:Mw+jjgntH9XqcnW85SbTIWIqspY

    Score
    10/10
    xenoratdiscoveryrattrojan

    • Detect XenoRat Payload

    • XenorRat

      XenorRat is a remote access trojan written in C#.

      trojanratxenorat

    • Xenorat family

      xenorat

    • Downloads MZ/PE file

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks