Overview

overview

10

Static

static

10

xenk.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    xenk.exe

  • Size

    45KB

  • Sample

    250219-st6rpsvpt2

  • MD5

    5c53cdb9e94aaaeb3dd32b00f24a9682

  • SHA1

    1fd311b3a335bc026f59f8a7843be45a41c627e0

  • SHA256

    6f05bbd743ea9ecb152a989ab23a4f0425fb45a95c2268036f1f627cbecfa88f

  • SHA512

    c4b364e2c181358bec743be3484cfcfec50f0f4c265a05f90eb9ea0519c63dba764ccf3ccd2ea671b175356b39809748d22430daf1afa83a1191fd43a88988ac

  • SSDEEP

    768:KdhO/poiiUcjlJIn7FH9Xqk5nWEZ5SbTDa6WI7CPW55:sw+jjgnpH9XqcnW85SbTzWIh

Score
10/10
xenoratdiscoveryrattrojan

Malware Config

Extracted

Family

xenorat

C2

192.168.0.178

Mutex

Antons File

Attributes
  • delay

    5000

  • install_path

    temp

  • port

    5631

  • startup_name

    nothingset

Targets

    • Target

      xenk.exe

    • Size

      45KB

    • MD5

      5c53cdb9e94aaaeb3dd32b00f24a9682

    • SHA1

      1fd311b3a335bc026f59f8a7843be45a41c627e0

    • SHA256

      6f05bbd743ea9ecb152a989ab23a4f0425fb45a95c2268036f1f627cbecfa88f

    • SHA512

      c4b364e2c181358bec743be3484cfcfec50f0f4c265a05f90eb9ea0519c63dba764ccf3ccd2ea671b175356b39809748d22430daf1afa83a1191fd43a88988ac

    • SSDEEP

      768:KdhO/poiiUcjlJIn7FH9Xqk5nWEZ5SbTDa6WI7CPW55:sw+jjgnpH9XqcnW85SbTzWIh

    Score
    10/10
    xenoratdiscoveryrattrojan

    • Detect XenoRat Payload

    • XenorRat

      XenorRat is a remote access trojan written in C#.

      trojanratxenorat

    • Xenorat family

      xenorat

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks