General

  • Target

    EacSpoofr.exe

  • Size

    45KB

  • Sample

    250326-fc8hra1ls4

  • MD5

    c714ff942179e6dcdeddf82da17a53f8

  • SHA1

    cbe52d5c8c74ccf29d7d047a84e87d8002077845

  • SHA256

    b26ff883b2cbd4fb188d37e7ec073ac5db545346b3ba748108bd5c55fb48cc23

  • SHA512

    ff272c360751202298a83b5076256b1824a8935bf27fc749c372e910ae992c00adb971c36cfe969f332671f756d9d9931209cf3e0c5705125963ebceac74bfbb

  • SSDEEP

    768:1dhO/poiiUcjlJInhZZbH9Xqk5nWEZ5SbTDaNuI7CPW5E:Lw+jjgnJbH9XqcnW85SbTYuIc

Malware Config

Extracted

Family

xenorat

C2

Knokaaa-35772.portmap.host

Mutex

Spoofer_Free_nd8912d

Attributes
  • delay

    5000

  • install_path

    nothingset

  • port

    35772

  • startup_name

    Microsoft

Targets

    • Target

      EacSpoofr.exe

    • Size

      45KB

    • MD5

      c714ff942179e6dcdeddf82da17a53f8

    • SHA1

      cbe52d5c8c74ccf29d7d047a84e87d8002077845

    • SHA256

      b26ff883b2cbd4fb188d37e7ec073ac5db545346b3ba748108bd5c55fb48cc23

    • SHA512

      ff272c360751202298a83b5076256b1824a8935bf27fc749c372e910ae992c00adb971c36cfe969f332671f756d9d9931209cf3e0c5705125963ebceac74bfbb

    • SSDEEP

      768:1dhO/poiiUcjlJInhZZbH9Xqk5nWEZ5SbTDaNuI7CPW5E:Lw+jjgnJbH9XqcnW85SbTYuIc

    • Detect XenoRat Payload

    • XenorRat

      XenorRat is a remote access trojan written in C#.

    • Xenorat family

MITRE ATT&CK Enterprise v15

Tasks