Extracted

• • Target

    Tutorial Files(1).txt

  • Size

    2KB

  • MD5

    5600477fbd3d6bde63f31d2ceaf95d5a

  • SHA1

    b2e700cad0d80e19ce84750ba55ca387f0bd4bf3

  • SHA256

    6025d9decad215703487c83f75ccf9d5f528bed582ab809ddd117e372424dc72

  • SHA512

    d8586a1daa7a9d73d1ee3cf72ac62f799ae687107ffcb83a7b6d766d6ed15b6ea46ab7f013a5461701f4af4f4aedb2391d3759030f3c0f26ba868efd3cf0053f

  Score

  10^/10

  xenoratdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationrattrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1