Resubmissions

28/07/2026, 11:17

260728-ndqckavfkc6

26/07/2026, 16:31

260726-t1g8csysex

26/07/2026, 16:28

260726-ty6g6sysdx10

General

  • Target
    https://github.com/moom825/xeno-rat/tree/main/xeno%20rat%20server
  • Sample260726-ty6g6sysdx

Malware Config

Extracted

Family
  • xenorat

Mutex
  • Xeno_rat_nd8912d

Attributes
  • delay

    5000

  • install_path

    nothingset

  • localhost

    127.0.0.1

  • port

    4444

  • startup_name

    nothingset

Targets

    • Target
      https://github.com/moom825/xeno-rat/tree/main/xeno%20rat%20server
    • Detect XenoRat Payload

    • Family: XenoRat

      XenoRat is a remote access trojan written in C#.

    • Executes dropped EXE

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

MITRE ATT&CK Enterprise v16

Tasks