Overview

overview

10

Static

static

10

skid ip only.exe

windows10-2004-x64

10

skid ip only.exe

windows10-ltsc_2021-x64

10

skid ip only.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    skid ip only.exe

  • Size

    46KB

  • MD5

    aefa96ed190a866e6a3cb1d80c68d497

  • SHA1

    e8449d566506e6c153d536cff3e444e73403d4ce

  • SHA256

    ac7797b246bfd72068e3cb41f7a9b7db3275a2791969626198f323434fbb0f84

  • SHA512

    e2a8ba27a0b1972b513caee831bcd5175f6407a3cdc6d061782049a608f3ed2c457b0b914589967bbd6e37f06173f5cf1bf735e032d882e47287e4d1f92b38e0

  • SSDEEP

    768:cdhO/poiiUcjlJInXJH9Xqk5nWEZ5SbTDaJWI7CPW5p:Ww+jjgnZH9XqcnW85SbTwWIR

Score
10/10
xenorat

Malware Config

Extracted

Family

xenorat

C2

193.161.193.99

Mutex

skid_nigger@skid_C2

Attributes
  • delay

    5000

  • install_path

    appdata

  • port

    20192

  • startup_name

    Windows Updater

Signatures

  • Detect XenoRat Payload 1 IoCs
  • Xenorat family
    xenorat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • skid ip only.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections