Extracted

• • Target

    Release.zip

  • Size

    6.4MB

  • MD5

    89661a9ff6de529497fec56a112bf75e

  • SHA1

    2dd31a19489f4d7c562b647f69117e31b894b5c3

  • SHA256

    e7b275d70655db9cb43fa606bbe2e4f22478ca4962bbf9f299d66eda567d63cd

  • SHA512

    33c765bf85fbec0e58924ece948b80a7d73b7577557eaac8865e481c61ad6b71f8b5b846026103239b3bd21f438ff0d7c1430a51a4a149f16a215faad6dab68f

  • SSDEEP

    196608:SYNI1S7C6S230UwVLW83FUSA7WQZzwM3/C2cM7m2:rNIs7CDvB1USA7WS/vcx2

  Score

  1^/10
  behavioral1

• • Target

    country_flags/GeoLite2-Country.mmdb

  • Size

    6.0MB

  • MD5

    1673baa69e09910f4e9141074163f9cf

  • SHA1

    36465e9d0d568c53e0395e71c3a9c46eed307b4a

  • SHA256

    064028784d81d283ff936eb5bbec810d81e8c85530c46e5717e5d7bd7dd3adb9

  • SHA512

    e21c99278496ac96d514484cb440f2f743a2509c69888a6694c25bfc478cf797ac858d4e32abe678a4aea96ed0ad75b1980d2a1537c85e626a119b24c93e7b37

  • SSDEEP

    98304:yqDYYo+XRm+ESo8TTChvcy1vdT4ote+YqPxMsc:yqkYZRmxF8TChjZZHte+YqPxMsc

  Score

  3^/10
  behavioral2

• • Target

    country_flags/ad.png

  • Size

    1KB

  • MD5

    68474a4935598753955993ccbd7062b3

  • SHA1

    79f32a99fa7a3761d7e7b592bbac279c7a1d5559

  • SHA256

    6e45d3cec2a17a9b9353b68288934e7c4931a36ec271b595750bf8441afae019

  • SHA512

    631cb2594d55d14f3321cb1975cf7e35ee0e79d63c9eec23a39851849ef17cfb81edf74a6f906d92ef4dc9ed48c230ec7e3966e71a91c603beb6708f81aa90fe

  Score

  1^/10
  behavioral3

• • Target

    country_flags/ae.png

  • Size

    687B

  • MD5

    0aad6b193a525af068832a5f3312dc3e

  • SHA1

    75d2268655d2e9c2cfd39f4512c1ba46d701e91d

  • SHA256

    6af9e1cb4e4c86a1d1b9f2fdb5c9a4eb554f4cfb674d8357f2e7e1086de4b4be

  • SHA512

    0cbbdba73d929ff425b55abc437b82c8b56f29ec9a7b59573d134e3df5ceaf8bf928f0c4049f7a9b09638337cde8cc9cdcb0a823101d121ce99e57f5f5726cc2

  Score

  1^/10
  behavioral4

• • Target

    country_flags/af.png

  • Size

    1KB

  • MD5

    b438e2fcc22b7b7138a2270b0c46c11c

  • SHA1

    a725f3930551e5d9ff2c719d1a159942c33ee659

  • SHA256

    2e738e232ba262bd7b40d39f0a8ef1b68204381b0f5d97367c8b827aea9e83be

  • SHA512

    01df36890f1cf4fff686ae1c16f2e18edb5fd2b88ba659e3cce651b3ffebe371e4dec1fb16b27c2714a6d4dbace1c7da9e7c59aff58579b111b444622eceff13

  Score

  1^/10
  behavioral5

• • Target

    country_flags/ag.png

  • Size

    983B

  • MD5

    f16d86d6cd9efed9d56c4e27222225cc

  • SHA1

    2e1a7b01df725adcbdde98b683a2788c68eeeff2

  • SHA256

    8cf632b5d10c24e29c68082bdba8737269f5160360985f9c306e8b20940552ac

  • SHA512

    5b970073ad7b7561311d83ab5bd8d6de5486be90fd6e4ddf0581eadbdfaf007926ae8747141cd2bcd243bc254bfe0eb2db0ea3db01759361601350759d426a8c

  Score

  1^/10
  behavioral6

• • Target

    country_flags/ai.png

  • Size

    1KB

  • MD5

    2e5628753b22d149925f2edca861cce8

  • SHA1

    eb12eec16eceaf289cb33cb4cd777b369d85e793

  • SHA256

    d95df82e43d2e94018a777083e68bb5a00260912037fc02243ddfe3a0a377f45

  • SHA512

    7db7b846c7710e8733928113acb9f70893ff16d06775c9862d03d075ad0fbe429a382df1f26ebd4836eefeabc1b8cf7734a7ef1b4b478c45cc2bf5ed2a1e8be8

  Score

  1^/10
  behavioral7

• • Target

    country_flags/al.png

  • Size

    757B

  • MD5

    8109adb0c3baf5d82c44385afb369943

  • SHA1

    4bc749135d32c08bd0557bb67ddc98a858354835

  • SHA256

    2e005216be2a847983ebe9a5a4b4ff2936c9008cc7c925ed7059350d4fcf370d

  • SHA512

    56f8f92eef8b8ae2e79f0a3a3b08df2ca22da658cd417fc3928d0895058776536f33ae93b61be7032295c9dafbc9b369016a16be0e0a4aa3243ad60f3ac3ff1d

  Score

  1^/10
  behavioral8

• • Target

    country_flags/am.png

  • Size

    887B

  • MD5

    d833529f7fa3d6229f5d2022dfefd1e6

  • SHA1

    6f46a741c8f13f4811fff2be726617cc679f5514

  • SHA256

    484fb381d03d5e519fab2c4dde2b78f13e67594713dcf4083a55d713a1eddae7

  • SHA512

    126c39597b26569f52757cd16796886f180b04d78182070a586852df87413205e01d4e6fe9e041da207011804fba3db6c5f0adc27ab378ce7a6ddb2300b1ac75

  Score

  1^/10
  behavioral9

• • Target

    country_flags/ao.png

  • Size

    734B

  • MD5

    1b6993d439cd730838399aec3b0fb44b

  • SHA1

    18b30a13eda5a7b00e1ab12f9b7534ffbcd3eedd

  • SHA256

    27e99589098bf031636fa0eae8ad7881e54181978135375c7f599f6e49fa8fa6

  • SHA512

    4ab06e0d6eec0cd1480baf66d5c4bb9d5a88ca0cd16d95b52bc2f26da23c18a7b63a75f4cddc27d4b7563375d1f49d3deae8b108adff29c3c0a0dc520307ffd6

  Score

  1^/10
  behavioral10

• • Target

    country_flags/aq.png

  • Size

    793B

  • MD5

    bf7280a322bac987ee3e421dbc5f6330

  • SHA1

    6c4a9108c1a5125975f235df5956e7bc16794d20

  • SHA256

    956390e90c1a201ed454b741eead49964393c3026d5882c47b02f564c7c94564

  • SHA512

    d037387964cbc1c6fcb1efc780996886e2e92fa580f374fc7ae5026854635209f69efb6f57e0a65f06a1e3fd60a8ebaa31482f2f278e9af1c4efd90a345fe2f0

  Score

  1^/10
  behavioral11

• • Target

    country_flags/ar.png

  • Size

    830B

  • MD5

    69cf780d75e1619d4ef97a1cfb485f37

  • SHA1

    8d65ef01654415778dbfe664a4c3167ccd5cbbbe

  • SHA256

    8438d5e69e23edc2054c6ca8f5b5eae4bbda37adec341a2f63e44ec7af2ee3ae

  • SHA512

    df83d8938e5d7508b385a209bafa0ed11afdfb0dd8d4e16782e397f0addd2c54d1a55dac7bc14a704b50010ba1fa013041d8fc19aa3b98126614e0282821658e

  Score

  1^/10
  behavioral12

• • Target

    country_flags/as.png

  • Size

    1KB

  • MD5

    d3fa2caf8084ea005f29dace6a1c1a2b

  • SHA1

    8922a843a5a7b6ecb0a47dfef6525346b762b64f

  • SHA256

    4c4d9b46ee8b8648976fbf45f3baa20f1d2bd81d955f4ad12e5f185f0184bec0

  • SHA512

    fdc0ed2421d1c9a1dd8199cb047a35c6b25cbb231dc0c2beae22c9dad997273d73ebd1e3a4f52f980909c1dbcc3157832eb73072d23c77fc76652dccf7c4b341

  Score

  1^/10
  behavioral13

• • Target

    plugins/Chat.dll

  • Size

    11KB

  • MD5

    0e5695b84313f7ed7b86dbba80b0342a

  • SHA1

    1db6a341dc01460c0c42690e42e2af2c57e53a4a

  • SHA256

    fe7677898bda46cd4b88d779b83545c2741f047ba45a3b45cbf3e6912b5d0a14

  • SHA512

    b8b67521ae69968bb5e0567a646b1b99fa8ec0db74fd7fc1e2482d036e775f7103163bcd2a6d6194d9e3e24efdd25bdcba35e1f76dadd79b01d762da8df28b58

  • SSDEEP

    192:Xt5SEw0NmpdxSE2sECoxmTNny9+EUrcya8Vk3h:9EP0NmR+CoxmTNng+EPy1Vk3h

  Score

  1^/10
  behavioral14

• • Target

    plugins/File manager.dll

  • Size

    16KB

  • MD5

    0746f23b790fd439980d155a75e6275b

  • SHA1

    c851f8b269cb82ed1a1dab1dc106edd5e95b6d04

  • SHA256

    fa08d4b54719f477eee7a7ce9d75dd84bc123e7f8b8546a1e2a394743fa319df

  • SHA512

    2569ad1c09cfb478cfba3ca44276cea443de91a1e66181968388052f0d06cd8be497c5959c0863709d89ab380bcdb3edccfed4fa7207f16ec340474f45bb6bc9

  • SSDEEP

    384:AAlqtn09rDgrPhQJBLjQ2z0A7VBvBGQEwZmya1HGrJxEKNX:f52qHMe0A7Vlo331mrJbNX

  Score

  1^/10
  behavioral15

• • Target

    plugins/Fun.dll

  • Size

    10KB

  • MD5

    b7c76350514a33374f4597d219d9fec1

  • SHA1

    f29cad3c62c7c827b1c46a412b842c71ad8f7fe3

  • SHA256

    cbf43a078e26e01184b89bb54f0469291946061426fbcf0ecaf6c205bd898812

  • SHA512

    a9c7fd686d73987de75103e772471c084a2913a5087fe827763ac01ec5960abac77d00409ba8cabbea0260c27561975a1519392a845f4dcb842c3e02d1ccf202

  • SSDEEP

    192:mySQnh/1lrzXHfvzHfR8B+E9E1gdZ9ONBh6:mpQnh/rnXHfvLfSt9E1+O3h6

  Score

  1^/10
  behavioral16

• • Target

    plugins/Hvnc.dll

  • Size

    44KB

  • MD5

    5353c15bee04dcac54f80dd7d5660b21

  • SHA1

    2663966150926b2528e4f04913b97bfd7ef988b7

  • SHA256

    b029348ff669a2ec5f042376f0b31049688437c7b6ce1d7c36fb7f03d4224932

  • SHA512

    3a1ec391fd8e7008d6398078007d0eab071c2b563cd05bd0e3228e3b73e775ec2504b39c81989a3d928c5a6afc1797ae76dd3079ba1515f60813f9b34e7ac9f9

  • SSDEEP

    768:x6WH72TsRqvj62N0MPVxKVgr3TcJoQ8je8WHJiCVg5t3l8hpo31e5TtOR6iKPeyH:0WH7b2N0kVQVgrjcaQ8je8iJ3ot1cmaZ

  Score

  1^/10
  behavioral17

• • Target

    plugins/InfoGrab.dll

  • Size

    971KB

  • MD5

    86bf07899c4e9764b0752713fe6f12c9

  • SHA1

    813924938e367a361c1145ce135e078967d7903e

  • SHA256

    11a09734dc3a412ef8130a65a0c06b1ccfc24673d818959cfe50f6b462e33d67

  • SHA512

    bb0ca1445b0215ca3bb85defea6fc902618218be04ce006565753c13e3fb3cf786d8dc0fcbe4f77443be28feefe8331e710d895ae8e0b20455b15e7a8bb94578

  • SSDEEP

    24576:GOGlTjiaeAeOTKAzbARntW+hZxCNqbo6RVX8sa6AtWZl2cFkN:GOGNjiSZTKAzkltDhTCcVX8saTtWycO

  Score

  1^/10
  behavioral18

• • Target

    plugins/KeyLogger.dll

  • Size

    12KB

  • MD5

    1e8ff2a86962488515380c6a27a775c3

  • SHA1

    39e1f2f4f9e113e7657abc4adafc8fbd0a5ad016

  • SHA256

    cb199fb2fee33300cea0f9b30ad0d3287206c4b1fe380eaa4fa7040b184510a5

  • SHA512

    b50ba227037580e1d68eb4ca9a4a751739152716b9e11e2b2b8e6ca0254f043a76e58d3a7e4b790c3cfb46fa1b6676bd74285b6801f1f0c0d00565c4f78f7168

  • SSDEEP

    192:Wv+i+cBHIDQkHTvckioy8p4Wbj5Lg3iZEYiRL9eT0pqfAp0FSkiXHB3K:Wv+ifODQkHTvBi8Rbj5zEYiR9eT0pqf7

  Score

  1^/10
  behavioral19

• • Target

    plugins/KeyLoggerOffline.dll

  • Size

    22KB

  • MD5

    4cf2a22b5fefa18e2ab36a1d73f79833

  • SHA1

    eb38e955e34998235040da965979e09d5d88df6d

  • SHA256

    3414c471c425ab070896e77df290debd5708748d02cd48952c69133795b4abe1

  • SHA512

    0ad3666f9f6b942be9c48cf9d24660faa0b5aa3184e08d9c1b9414220b60cbbfab19c8a082f72c79949edc3ca1b446e53d0f1452e569f531b90ca768f0550161

  • SSDEEP

    384:tgqiSBJEMs8uohRFeD4nws5lGHEKVUQlDUqajk7oHVEzipi9eT0pqfAp0FSFzJDJ:acYJn6lGkiHlDF/oHBoz9JDVz

  Score

  1^/10
  behavioral20

• • Target

    plugins/LiveMicrophone.dll

  • Size

    494KB

  • MD5

    afb916213f3419be21a061b782793c6e

  • SHA1

    6625e390d96820483db6fc9efba739456a0f2fe1

  • SHA256

    77a9318b937fbc733f5a53c12ce1cbc57aa49504840da6e33f34a1750879a8f5

  • SHA512

    253ca98f2a6b351f2a28f38a18a34ecb7583dee5895fac871cdc0f08dce51a04fec9e684d0a459b147ae6588c67c7c841b6bb32f510c529ddcc3460e45ab9d98

  • SSDEEP

    6144:S7E2hItIqKU1zPf7sQwd4h4dY2S/rfWTEFB44PjrKkpArI9ZQf9yZ86DyXLmqwH5:SjHUlxd2STf44PjrKWYmVn6D0

  Score

  1^/10
  behavioral21

• • Target

    plugins/ProcessManager.dll

  • Size

    17KB

  • MD5

    4dac21b4f2984931b9710ca50329023a

  • SHA1

    e92c1284f58e2cf339340ff5496f94f9183f127c

  • SHA256

    8bca46a92123f0435b98174d0d1182016811905c7cae6199176d1d3e94605e67

  • SHA512

    36b9c7c23ebf21fc6523ca309d49966c06eba488cb7ba807f496c9effaff7e31ed8e166cab8392352b7efea3dac748af69c5de0b5cf9275fbc0616c0a75af1a9

  • SSDEEP

    384:GOQdVyeIdKbl512kg3EHEeGdhCaXJbuLUSJZAnVb:GXIeIdKbsEZaZyw

  Score

  1^/10
  behavioral22

• • Target

    plugins/Registry Manager.dll

  • Size

    12KB

  • MD5

    70bfb60e65f7fbf9fbcee5c8aaa3fce7

  • SHA1

    da65c59851dfe52e22ceaf3498a516edb80510ef

  • SHA256

    684e07c2cca9deddb34b52e791aaa43a223d31b31a06489ab22cf79090504000

  • SHA512

    bd2280d7fe342597f2177c37d836c7d40102cf9892cd54ecc07405f88488c1335d7ba0dc489860106825de98a133bf040420b79bef5b97a848fd11f81ba2c143

  • SSDEEP

    192:fQ/AstzyaRFzlMXR5DfXXb5BCOrv6qOBPEUbqfINBt:IVZFzlMXRFXCGEBPEUxp

  Score

  1^/10
  behavioral23

• • Target

    plugins/ReverseProxy.dll

  • Size

    14KB

  • MD5

    039d1f0dc21cd752cac608434b205e3c

  • SHA1

    baacefeda4cbfd8e6adda01f25f2f52059805d76

  • SHA256

    c1b7f81f0d40e4ed6f31235f502792e1ae2c2866254bd492b302498377f0aac8

  • SHA512

    4c2211a4d7b4110b3ba6f71105781140436ac57d1b191ef9a22d8adb37ba0fa1c2513fa28a336b29a62b7aaa7cad2295115da8e76fbf6da230cd25e9b1cb8383

  • SSDEEP

    384:3ar3GmyvRMMCYLopROCM0jo/s1Vaxy5xa1EVALLPO6:3ar3GFJJ0pROCM0tVKOa+6PO6

  Score

  1^/10
  behavioral24

• • Target

    plugins/ScreenControl.dll

  • Size

    14KB

  • MD5

    e402280a434814fd9eecb5077b8aac62

  • SHA1

    d120c97cef608e9f234b4d08a62d1cf7d45e5b50

  • SHA256

    d692123e16293f2d41a16e1811ae090324a3f611b694820888008ec6102fae54

  • SHA512

    8f0725702b21afd56a2631ced5d999ac04c5935f3bc6c637a97af4d3d648cc9a51231a87706e64708ef9ae33e51a3edcd1ae3bcafe6d0009a8cccaa2f3a13cc4

  • SSDEEP

    192:ZdOAWZMcRZ+U5FMvZwzUgJKaJqj2MSglwloMWxqR0Zr2v/BmqRPEZDxI6:ZdsKW+sqacj2MSgLxTZr2v/U4ELv

  Score

  1^/10
  behavioral25

• • Target

    plugins/Shell.dll

  • Size

    9KB

  • MD5

    5e3e4438045c426410122210759cc0c8

  • SHA1

    c7858413c6b724135afeb1f878f986b0ae1bfa46

  • SHA256

    81bb6bed470afa97db39d7048dd8d9b7c7786fe8297f51390b5c83b450cdb5e0

  • SHA512

    d0a656048deaab2916bd98f5205bda41686891eff65ee7608117157e4f04ee22dfcd8b9bdccbce1bdd065a1573229c3996122b907a303b8494ad7b730fe5d929

  • SSDEEP

    96:25ATBzB7uwBHfse4hDjl2KQ1dndjVvIibvibKh0c9v5g+m2rwBGbEbrxtZfvPn2k:25kFDMlor1ZT5guvbEJtZ/2WYC

  Score

  1^/10
  behavioral26

• • Target

    plugins/Startup.dll

  • Size

    6KB

  • MD5

    d66568e2fd174b6cc4f5aa10d9ab9ec6

  • SHA1

    8ae0f67d073d642c4ccb879d48f71dd39f167ed6

  • SHA256

    b82d8d11aece746a4202730eaa361501e4e505d6456f110b6bbd0a42f2b8ec0b

  • SHA512

    48b01dfeeb01b2eb103cb93834769a89de79f5b4d9bc8b3b255bfdf4b35f7e02abf0ecab0949d008d3c5b9d004101014befc6d509cd747850c072cefc369ef04

  • SSDEEP

    96:02Y9OJCE5Bdx2dix/BKsa7kh+qxH5Bxhj+0p66ljIzKtMy1MOgM03M:rXfOO7V+0pDlj2S

  Score

  1^/10
  behavioral27

• • Target

    plugins/SystemPower.dll

  • Size

    6KB

  • MD5

    b1aca76ee8c1d3fec6edd3a31f9728d8

  • SHA1

    859338c0a542697338cb72e7b2f07faf9b9fce2c

  • SHA256

    b01ab0fa54986d58b4665492639dbf16ae22e8ab868678ecb0411f06791d8c2f

  • SHA512

    83bba2d5f6826fb614f16f25411ca83a2207a18e4992e9f785efec3383a5461d861cfa1e080e1e3f3a1c69c93b3b237ca9c0c2641c276ab074aaf98ce340cc04

  • SSDEEP

    48:6D8vMrTBK/pal72gw2wS43qLirMZAxW52Qivmd4M2UP+o1nEGh+4PJ6xnckqtts9:Jah2ZSlNWxW5BxZP+UEL4lksUil8

  Score

  1^/10
  behavioral28

• • Target

    plugins/Uacbypass.dll

  • Size

    18KB

  • MD5

    d1d9aef0ed8093ff1ed157bb4af3652c

  • SHA1

    f42c6258e2ade01d14fe4fce4d51cd0b05569417

  • SHA256

    7c67304b2c4911b9a394604d92e7dfd48286f6aee89c81ddd96c922ad67a0a65

  • SHA512

    eab2b498c602105a158d7e167ea0929efadd488328f0cdaf43f65a87430f333c5aae74473f4b4652a21107b3056aea7f3d472098a0fa2cae32d6f687a7ecde10

  • SSDEEP

    384:AeI8KomqLwYgwQ+wpGT1FpAZ4tpnt3sGXbbveqiMZ2eiEB487XK:PfE4jtc2bbvZQAB4oa

  Score

  1^/10
  behavioral29

• • Target

    plugins/WebCam.dll

  • Size

    43KB

  • MD5

    c554ddb5db3ac1539d9ab7de049b8486

  • SHA1

    050e77b2d762be186960cd4f4f2b1e476fd268a2

  • SHA256

    3188c001ab60a37ca350093f7b53ebd01cb24950ed5b68331f5ff19ee28fc416

  • SHA512

    f0a372740ee090a91e74d57760f459cc4022adadb421eaa6c6d285860e4288d13d5435d7f575175e8f9ca77819cd833509070124d6f7d121e7708877e579d3ef

  • SSDEEP

    768:owsh76M4keW4Jon9Y5S3WlbGWFDKyUkbmPSIUdn+ybRuIZ:nshj4kuJe9YrB55JIUdn+yXZ

  Score

  1^/10
  behavioral30

• • Target

    stub/xeno rat client.exe

  • Size

    46KB

  • MD5

    d23d8120af87a615a456a12b43d4a98a

  • SHA1

    73b41123d6f50aecdcf1c5e87a7d0319d753b0e7

  • SHA256

    27178a08e0d8fb6e5e31ae9bff6194a5224406666fa1f528d4719c1e4a8efd67

  • SHA512

    99026704fef97f9f9c01348310f199ad523851e105c7ea1f39312c7370cb6e50af5044fec1041298b96b6e661ac5f48d6af80687e21364806e62738d198ad319

  • SSDEEP

    768:Ddqf04XKojwYybbZWsiBHUuOkU7cK9F9km3XNZ5SbTDay6t22:D4z0z3ZWsiBHUuY79kmz5SbTL6B

  Score

  10^/10

  xenoratdiscoveryrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat
  behavioral31

• • Target

    xeno rat server.exe

  • Size

    2.0MB

  • MD5

    3987ee127f2a2cf8a29573d4e111a8e8

  • SHA1

    fc253131e832297967f93190217f0ce403e38cb0

  • SHA256

    3d00a800474ddf382212e003222805bd74665b69cec43b554f91c3cd9edf04c4

  • SHA512

    69d5ac7a691dde1a3ed7f495e9b9180e63152ddaaa3d1b596ad9cbeb4d7b088f3fc4b138ecf87070014cdfa9047be18940b720de60642389921a10053250787b

  • SSDEEP

    49152:EnxkNTRWjxoJochWQI3kqXfd+/9AManGhR0vNgtIeGWtOc5Q:ExkNTcaJhDI3kqXf0FtWykQDCiQ

  Score

  3^/10

  discovery
  behavioral32