Extracted

• • Target

    BootstrapperNew1.exe

  • Size

    50KB

  • MD5

    1eff35c8530e3775e44c9f7096ebcda0

  • SHA1

    41b00fb6bb5d0cece18910d3789f6a70b5eb1906

  • SHA256

    15b6b5588bca8c558900e44092cb741a872974e33ccb8547618cad751e464b9c

  • SHA512

    7ae7b6e09b8afba8b27fa4db75c100659ef1e671c11b877067763ebf352f3a05404c71e587727e3cd15f68acaf539da4328f6785e4c28646e8e490c4c98903e0

  • SSDEEP

    768:qdhO/poiiUcjlJIn3dH9Xqk5nWEZ5SbTDa5WI7CPW5ispY:Mw+jjgntH9XqcnW85SbTIWIqspY

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2