Extracted

• • Target

    d3cf947d7de87f91088ebaa37e34b062c3c55231134ace457cb3f8507c373243

  • Size

    45KB

  • MD5

    840fa8abb722e9df060e055f9e13802c

  • SHA1

    37a89afc9b1487b7bdb77122c7f100b89d3fc50d

  • SHA256

    d3cf947d7de87f91088ebaa37e34b062c3c55231134ace457cb3f8507c373243

  • SHA512

    d86d5b3a988fbeb884a15383b888715432e3cab36953f08e1719640cb9d3bf8382495fbb3b4b317f55288407e70643f7598c70421d0c5c4d9d221e892de89783

  • SSDEEP

    768:LKpu9Tv4A4QfJkwINr8I0SeMhQoRFywB/ZXD5DtZ9bEUjYfAFkv:uc9z4rQfwNr8QeMuoiwBx5Dz9bEAYfoq

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2