Resubmissions
24/03/2025, 03:37
250324-d61nwsyrv9 10General
-
Target
Bruter.exe
-
Size
45KB
-
MD5
b5b33c70e1d697300ecdf91890578b81
-
SHA1
0114e3e5c45e627aa81041a5b0209caaeb52b300
-
SHA256
1e1544521f5edd419e91a79e6ba9f210cb0ac4eb1eab24c1bd76e48f72835312
-
SHA512
b67552c461bfe3219986fbc559e0ef7d9453406fff5a9abe4240a12d10152973ba19a575a6b0c632456213a24ce2c8dcadd8ba29578cf0d91406c3a023a6b4c2
-
SSDEEP
768:NdhO/poiiUcjlJIn8aH9Xqk5nWEZ5SbTDaAuI7CPW5c:Dw+jjgnjH9XqcnW85SbTtuIk
Malware Config
Extracted
xenorat
147.185.221.25
Xeno_rat_nd8912d
-
install_path
appdata
-
port
36426
-
startup_name
Windows_Host_Proccess
Signatures
-
Detect XenoRat Payload 1 IoCs
resource yara_rule sample family_xenorat -
Xenorat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Bruter.exe
Files
-
Bruter.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ