Overview

overview

10

Static

static

10

aaa.exe

windows10-ltsc_2021-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    aaa.exe

  • Size

    45KB

  • Sample

    250520-z4tnfsxnw4

  • MD5

    3cddec3cdedbf242616a011acaf94d18

  • SHA1

    0f10fc63f145c66ce06fec98b51bba3c11c2ddfa

  • SHA256

    003570fdfcd9fc6e884aa72347b38cf1e34bc8d099a849216b037932abae1f05

  • SHA512

    59d53f13f6c3b869e737c8cc2d66a293ee9ee938c49ea61a540d115a08a0aba4762367bd0808ee3a3764a399b562112db4b2cc5e7880366afaedde15af30c155

  • SSDEEP

    768:KdhO/poiiUcjlJInYFH9Xqk5nWEZ5SbTDaEWI7CPW55:sw+jjgnIH9XqcnW85SbT9WIh

Score
10/10
xenoratdiscoveryrattrojan

Malware Config

Extracted

Family

xenorat

C2

83.233.39.201

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    5000

  • install_path

    nothingset

  • port

    8844

  • startup_name

    nothingset

Targets

    • Target

      aaa.exe

    • Size

      45KB

    • MD5

      3cddec3cdedbf242616a011acaf94d18

    • SHA1

      0f10fc63f145c66ce06fec98b51bba3c11c2ddfa

    • SHA256

      003570fdfcd9fc6e884aa72347b38cf1e34bc8d099a849216b037932abae1f05

    • SHA512

      59d53f13f6c3b869e737c8cc2d66a293ee9ee938c49ea61a540d115a08a0aba4762367bd0808ee3a3764a399b562112db4b2cc5e7880366afaedde15af30c155

    • SSDEEP

      768:KdhO/poiiUcjlJInYFH9Xqk5nWEZ5SbTDaEWI7CPW55:sw+jjgnIH9XqcnW85SbT9WIh

    Score
    10/10
    xenoratdiscoveryrattrojan

    • Detect XenoRat Payload

    • XenorRat

      XenorRat is a remote access trojan written in C#.

      trojanratxenorat

    • Xenorat family

      xenorat
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks