Extracted

• • Target

    BootstrapperNew.exe

  • Size

    50KB

  • MD5

    e04ffbc3f3dd5111ff1334d266652b79

  • SHA1

    b84171d543dd9f345813f0220142b9cfd9132e12

  • SHA256

    cd2c66350bccdd0152b592b3e7cb2c999e7923171f21a2ce887ac0d4eaf2032a

  • SHA512

    d65f661bd54f6aec9b7b5c10c87b90071c84c0c6d5a04d3a0727c1fdcf4099f5da2e3aeba7502e71c55059f8618c7dba85e1eb24dee8014b798ecc6eded93c3a

  • SSDEEP

    768:qdhO/poiiUcjlJInvdH9Xqk5nWEZ5SbTDaCWI7CPW5ispY:Mw+jjgnFH9XqcnW85SbTbWIqspY

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2