Overview

overview

10

Static

static

10

XenoStuff.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XenoStuff.exe

  • Size

    45KB

  • Sample

    250413-2e1rkstpw6

  • MD5

    e918ab4b6c93aa0406977e25e12e743e

  • SHA1

    7c71b18fba8d3d3445d22d786cc535a1e5cba4b1

  • SHA256

    99b6e08bb9fcb03f3b52db8f87244b51469c4fb33e7769a0cb961d994de88709

  • SHA512

    267f86658c8bfa3f3120601c0f1b64bf630924e5317e385a17170312feff66d2e02b5d5114955175dfa0ffd340de9016538b4d6bfc32071dee6d3945d704c108

  • SSDEEP

    768:xdhO/poiiUcjlJInvvH9Xqk5nWEZ5SbTDaJWI7CPW5F:vw+jjgn3H9XqcnW85SbTAWIt

Score
10/10
xenoratdiscoveryrattrojan

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    5000

  • install_path

    nothingset

  • port

    4444

  • startup_name

    nothingset

Targets

    • Target

      XenoStuff.exe

    • Size

      45KB

    • MD5

      e918ab4b6c93aa0406977e25e12e743e

    • SHA1

      7c71b18fba8d3d3445d22d786cc535a1e5cba4b1

    • SHA256

      99b6e08bb9fcb03f3b52db8f87244b51469c4fb33e7769a0cb961d994de88709

    • SHA512

      267f86658c8bfa3f3120601c0f1b64bf630924e5317e385a17170312feff66d2e02b5d5114955175dfa0ffd340de9016538b4d6bfc32071dee6d3945d704c108

    • SSDEEP

      768:xdhO/poiiUcjlJInvvH9Xqk5nWEZ5SbTDaJWI7CPW5F:vw+jjgn3H9XqcnW85SbTAWIt

    Score
    10/10
    xenoratdiscoveryrattrojan

    • Detect XenoRat Payload

    • XenorRat

      XenorRat is a remote access trojan written in C#.

      trojanratxenorat

    • Xenorat family

      xenorat
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks