Extracted

• • Target

    xeno.exe

  • Size

    45KB

  • MD5

    6250a6de61be4f983423be8c78f9aa07

  • SHA1

    04ff439e9d6e42bcda49e25180a06b72c21b92a3

  • SHA256

    f6f7293893670d2aca6ac7208496e44c8733b84155e140f58ce85a0cf49211b3

  • SHA512

    4ad73a3ea7e553c63186d314339d7e6c2f290448ebe7b2a974ab17118fa49c72d3be471006f4a7971708702bea270ef76041ade40cc23b74c3474a23406a41b6

  • SSDEEP

    768:edhO/poiiUcjlJInYFH9Xqk5nWEZ5SbTDaTWI7CPW5V:ow+jjgnAH9XqcnW85SbTCWId

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2