Extracted

• • Target

    ninja-removebg-preview.png

  • Size

    214KB

  • MD5

    2c97b1e5a89dc38a8c906f63bd6676f1

  • SHA1

    b4bebeab59995284cb538eb1e987388ba5d1ff92

  • SHA256

    74bbfa3982830431f791a705d5e4100a52464a02af53ec884f19b23143309bfb

  • SHA512

    02557ddb7da84715043824172641ff670e382d88a3430da1ee6d884e010cd0bf61e8b9f0a1371197565ecc630320b2dd196d154b1b858ee63d39f34e8a2df52e

  • SSDEEP

    3072:51V8WMZwNkIRasbHGkOLnr6sOWew8zardin5gbuvs43kmE18hQrrVb2r6FAEX5uk:5kBsj7OJOJwKard0VVQ8hkVuYuTBUMa

  Score

  10^/10

  xenoratdiscoveryratspywarestealertrojan

  • Detect XenoRat Payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Xenorat family

    xenorat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1