xenorat | b8be22ca79a6c889595e5127517bb35f16272061de737e600159788a4fa11e9c

Sharing

Copy URL Twitter E-mail

General

Target
XenoRat 1.0.7z
Size 2.6MB
Sample260912-xe8pzavvhs
SHA256 b8be22ca79a6c889595e5127517bb35f16272061de737e600159788a4fa11e9c
MD5 ac7b983b9e821f5412f32b02c2c25aee
SHA1 b8516efb6f95166f5ce1fe3ebeb5f05144f05906
SHA512 e15df66aa45c2ca5f3f70bfd055d757bb89219c7c4c7bd8919689e572368f30f572ab610c3c61a2fcb4e060e1c39fa2b322a2f56c4a05dac11f59edec068b657
SSDEEP 49152:xLlJUA3pCLIxuXvgqqMxtOh5eLHWX0ZQGdnUQ9YkOEfhNLtQHCagwNxAQ0ld:vQB/rqMxtOhALHbZ7ehAnlQ0ld
TLSH
T115C533185F7950107F6A62C48CBC5C6383C48CDB9C5782D44FAB4B7C689FE29C49BAA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  XenoRat 1.0/Release/plugins/Chat.dll
- Size 11KB
- SHA256 bbc3440248ac51c40d4c0ffc743c88d29f7892fa6daa05223e21a231c6740f6c
- MD5 d6d926ae181195b631540ff2a1182441
- SHA1 05b7ce6cd4d8471085aa633d706dfdcb1e21b170
- SHA512 b39a0abad87edf604a261be63b379188fee55d532963932c7f2d03c85bfbb28d5da714df4b3ebb26960847206085108ce3382a3e8111f0c48f40bab5f33ad181
- SSDEEP 192:BaKPEl+b70Oa9/mteHEIdohCoxENny9+Efrcya8VkSB:UKPu+naUdIGhCoxENng+Eoy1VkSB
- TLSH
  T1AD321B256BAC4523CB7F6F7EACA353434771DB28A856EB5F1C8C91DA6CD63500802347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  XenoRat 1.0/Release/plugins/File manager.dll
- Size 16KB
- SHA256 0cf49fb79f955eedded565f8507ddf10dd69bb84e27fb5b3a42cb4aebef94dbd
- MD5 fec36282e3608ca6a3c3247271cfdf84
- SHA1 f9aad7b4eb250c79d3a466ead932bd9cf229c239
- SHA512 e7a629f7242511ba1d5d4f890ad56ab59596c95cc00ede928c2f001e7613a60411349dbb25d2ed450afd90c70a22dc422246943114c31115f88038ba3f10620a
- SSDEEP 384:qAlqtn09rDgrPhQJBLjQ2z0A7VBvBGQEwZmya1HGrJxE3N7:Z52qHMe0A7Vlo331mrJmN7
- TLSH
  T18B72949916AC9D23EE7F1BBD68A103434BB2E1369416F74F0CCC78EA2C9771115417AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  XenoRat 1.0/Release/plugins/Fun.dll
- Size 10KB
- SHA256 71448c3539a2f3d7cb965bc24072e1c2cb0ec7d5907020321591259076dc21f4
- MD5 9ac131e45ecbd72a246e4beeb8b85277
- SHA1 c55969ac917611072f7f3537681b30a7289ed64d
- SHA512 a2c0c78e9be9d51f42edd87932482f90aa21b74496a8997409b84e0c0a41e1300cff2e8ab13857465c4af3653627bd6ab75f0a95a5e56219cc8a57438d7b25bc
- SSDEEP 192:eQnUN71lrnXJ3hx9fR85+E9EcgdbVzONBhj:eQnG7rzXJ3hDfSF9EcEzO3hj
- TLSH
  T1D8220A6667ACC423EE6B4B7EBCE343475370E7295912EB4B58DCA9193C833014912B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  XenoRat 1.0/Release/plugins/Hvnc.dll
- Size 23KB
- SHA256 77c31acdd92f4851ac47c7fe90e8b11477f9e30663ca843d8069704b79432c1e
- MD5 e0c7078eff6470ec3aae20ed75dea5f6
- SHA1 8a1ee8902ad220ed84b08185c564b83f418ae23e
- SHA512 6d3d91426b3fa25be3c2dd0cd4a20cffe789cf15fae4b74cb3e348fb1e31ba440caec2ba869c457608994b12a8dc5bb5f438f0188062a8dc76cea78ec079b8a8
- SSDEEP 384:k1yWbMcnT/XSqWh9WvwOJ16IdXTvjbr72aHwRHB63IjqNiOZ0Ke9B/vXut8EtEYn:k1yWbMCqvOeI5Tvj7zuHB6Ym7ZQHutjl
- TLSH
  T12FB23B8AEB2E4123CD2F067DE8F3070A4BB1F6519D56F38E49DD90D69E11B81066236F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  XenoRat 1.0/Release/plugins/InfoGrab.dll
- Size 961KB
- SHA256 38b691f7e28e6db4f60e3180edc0e74ce6423f9e0768f121b6bf29447ab15811
- MD5 45930fbc93f5160ccfa1bce3ddbb6edd
- SHA1 32bbed8c74e9ef9e6418c3bf7b82b478f481db9d
- SHA512 989ffee980e65b90d771e7194c2e951644fcb7df75a674c31170fd0327cab6bf217cb58076f031a0e9e53d18336fb674aa4bb99261aeb066bb48b05322cd3d3f
- SSDEEP 24576:aGlTjiaeAeOTKAzbARntW+hZxCNqbo6RVX8sa6AtWZl2c:aGNjiSZTKAzkltDhTCcVX8saTtWyc
- TLSH
  T10F252319068DA326E7BF517DCE44115822B1F6C7F462E9CA8C8E189B1DF9BD1A0132F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  XenoRat 1.0/Release/plugins/KeyLogger.dll
- Size 10KB
- SHA256 36ec0a4d817bd9c169e249a4891af66dcff3234c0ddae3e84ccefd0417d66ab5
- MD5 0061afec60f592befa419c4d2d72b017
- SHA1 92ccebf2bd44f5d7e493b1a9f6e883d9c55d1348
- SHA512 440d38d753814ea2815cc91b002581f579505b5c4b0f46bee0d7103d2951fe44aaf28dc09c6977d94ae5dc166792c0a7cd5149fc4d76a20ceec9cf95a657598d
- SSDEEP 192:55NUy4+lAjCs+YLF6kQ67moddFE5ij9eT0pqfAp0FSV1zHB3K:55NUhzjdF6b671E5ij9eT0pqfAp0FSrE
- TLSH
  T15E2296017BFD8527FB3AA67AD4B312829735F92C5862DE4E1C7D518E8C72A412901F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  XenoRat 1.0/Release/plugins/KeyLoggerOffline.dll
- Size 20KB
- SHA256 2c043567a8c6385823ec4af2dbe11111e5d4f2b43ffe1638caf7df9214c076af
- MD5 82950e681536bb1972337435c98de43e
- SHA1 12f1c8dee3302a9074316569ba660e4522e73e4a
- SHA512 0b1815226e2212c1a2fdc05acb5ae6210355a6d26511b5d5f553718e3c6b94355c2db1ce1f04dfde6f52013093cd022c6621abacf1c6c7bb2aef425a1e8899cc
- SSDEEP 384:FOMQw5Kwb201QYJJN4HMSAj/AN0p6U2TvxRHVEAidn9eT0pqfAp0FSFS3:3L2o99wMvjo0p6UmRH0/zFS3
- TLSH
  T15192B60DB7EC8A23FB1F7BBD8472920B8B30B929A511F78D1C8C61DD5C667416852B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  XenoRat 1.0/Release/plugins/LiveMicrophone.dll
- Size 494KB
- SHA256 7c51466863d7c173c348f39ae6770bfaf4b58fc264fa4a108a3b349ae439afe2
- MD5 5884b171724bfce326dbfd777d51c6f3
- SHA1 9f0ab5b9774026a60bd7add39c32f3af18f340c9
- SHA512 59f0ed8c1368fbb405718937614837a6f1f6b719aac4cbd9bef63edcb9db0acea16583e232c795423487f6a27dc2dda1ae5b41980224c6a4f423f6a4d79c041c
- SSDEEP 6144:e7E2hItIqKU1zPf7sQwd4h4dY2S/rfWTEFB44PjrKkpArI9ZQf9yZ86DyX2mqwHc:ejHUlxd2STf44PjrKWZmVn6y0
- TLSH
  T1B8B46B5237E48A17D1AE2375E4F0050A4BF1F5473627FB4F8AD09AAA6E837859C107B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  XenoRat 1.0/Release/plugins/ProcessManager.dll
- Size 17KB
- SHA256 0dd0340cd784aa86a98993e3ff4f90bc04e532ee457a492c7b5f6e27fc39ede1
- MD5 0c031be12d22daf48c5e6a404ff8a183
- SHA1 351120fa2cbefa82a3d6926a9ccc172b546cce8b
- SHA512 f3f06a056e8a0502a34626a76e9b298ad2f508a2283f2c77e40ea841ba2c4f42b25c0d4e04f74dc0ea3ea41382e87777a93bc5345ee468f1cd78c14743fc242e
- SSDEEP 384:HOQdVyeIdKbl512kg3EHEeGdhCuXJbuLUSWZAnVb:HXIeIdKbsEZuZyV
- TLSH
  T16472C4045BEC4726CBBF8F7E6471834306B4FA158D23EB9C0D5CA6C21C63661E865BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  XenoRat 1.0/Release/plugins/Registry Manager.dll
- Size 12KB
- SHA256 eaa1d4e07300156f108c5583af1cf8e49959c1e335ed9880a24ea4e8f10d0d96
- MD5 9b170f18aac8cf3611504fe7b7284125
- SHA1 c53b099fc4b2339fc2ec50a671178e11c5d669b0
- SHA512 a5e6352d0e37084291fca5aef50ccbd3a7ab2752b69eb894f9067321caf667d4e1a592ca11e340dc8da45eaaef51c3dc34a519f184ef1a21b30fa48457fc055a
- SSDEEP 192:OQ/AstzyaRFzlMXR5DfXXb5BCOrv6qOBPEUbmfINWgK:TVZFzlMXRFXCGEBPEUd0
- TLSH
  T15A42E7089ADCC927FE7F1B7E99E182938372EA24B553EB070DCE95EA5C12300911577D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  XenoRat 1.0/Release/plugins/ReverseProxy.dll
- Size 16KB
- SHA256 39daec4001415cdd7be637a5b8eff157d58eee4cbc3903419af87cc98292ce35
- MD5 90cf51d17227afed872e5e678b3b911b
- SHA1 ed279302a32c573ca34ae6cb35ce94cdafb4cb99
- SHA512 c18e97ce616303a15807f10a158bd05dff641950dfaf1f897138e839c027adb400fb2490fc25e41bf04cb5ca8b21cf22c7e08dbc1162ba49cea25f9d7ee5b599
- SSDEEP 384:8hm5Thfmbajz2hENxSv4P0i2cw4kyWDdQt/OoPJ:8wf++z2h+Sv4P0EkjpW/OoPJ
- TLSH
  T17C72E78D439C9A23EFBF5A7E686247034FB5E221D651F39F189CA1E62C53342480679F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  XenoRat 1.0/Release/plugins/ScreenControl.dll
- Size 16KB
- SHA256 83b9f49e2e74dbbcc76767fb3ce91dd4086cc5f5448b5c240486553d7e64ef60
- MD5 5694f284170c442543a0dec3d1ab8f90
- SHA1 b4140bceeeb283fc859d37cd50fdb0c9f63d7af2
- SHA512 642c242b4af84bc2f79057f306183c3c38bb6c4aec4a87d4a553197d7ba1c33aa722b0e32c15e84a889b880ee4fe68596fd44e06378fd3ff5521445240b66f1a
- SSDEEP 384:UP+W/3oRhgUU01V5NgPbiPDS1Uxm17Ig6GgcYsm2wpWdsEpGJ7:bK9sJ7
- TLSH
  T1AB72D84C657D432BDE6F0FBCA8724A8A07B0E122E901F75F6CEC64F56C6239541427AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  XenoRat 1.0/Release/plugins/Shell.dll
- Size 9KB
- SHA256 4785ddcf8061a43922234f0a8f88799564be83873e23725d19980858c901d7e7
- MD5 e0d2610af6bb309dc30a603019e787a0
- SHA1 56c85c1cffcb21706cc95e4db76aa493c775af56
- SHA512 4190e5a57facaaffc155cff71315f91ced38fcb4bea0fc140bbe1d9a77fafc92524cc89b5cfa90fbd5565e3f63945641cd612b11f6de24b12e46310bd37a87ea
- SSDEEP 96:R5ATBzB7uwBHfse4hDjl2KQ1dndjVvIibvibKh0c9v5g+m2rwBGbEbrxtZuvPn2l:R5kFDMlor1ZT5guvbEJtZG2WY/X
- TLSH
  T17912D4085BB8C933E86FAA7C9DD1629343B1BA518C57EF4F1CDCB18B6C522900562397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  XenoRat 1.0/Release/plugins/Startup.dll
- Size 10KB
- SHA256 41779806b798db05ab1055dc95c102b6e8c7c53ce87229ddbacaf3d6da192c72
- MD5 097c4c4ff6ee48b6ed65f1d7573b6b88
- SHA1 2fdca8c417a3898352e662c4081fc2c47a7de137
- SHA512 8502ee6c24704b3a78a7981fde3fed030c9da8eef1c90b77883a940d5a4f13a4d55003de54938bfe17977433b6daa4155328c5d00400eab03d49881ad453eaf9
- SSDEEP 192:o2xSyMPsCJI7Zvb5lXEY+3Ele4k2y8HU4OGQj2+Y2:15MPsCJIlvMFE0/hjhr
- TLSH
  T123228307A7FC8517F9BB1E3DB87202130A73FA044C31D96E189C614D5FA3A218562B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  XenoRat 1.0/Release/plugins/SystemPower.dll
- Size 6KB
- SHA256 492ee481d64011a8472d47c342531cc2cbc97282a6f0fe1b08a5450f70e1890d
- MD5 7f8b6d6046a85dfd4abaf7b70c1a8060
- SHA1 c4fcde6f6c61e83af449e3bf5d2181e66ed66404
- SHA512 a4d0834d5859089395ebd0066680f8fb4d8d4d7eeb2c684490a9e7e3747affb078ee64d221a95e1985e9cbba6f85564338f4e5cd77e7179152534c7c463bf51b
- SSDEEP 48:6wE4MOTBK/pal72gw2wS43qLirMZAxW52Qivmd4M2UP+o1nEGh+4RJ6xnckqttzj:yah2ZSlNWxW5BxZP+UEL4LksUl8
- TLSH
  T176C1843267EC5633EC7F1739D86283524AB6F661AC13DF6F1CC9A5096C223024432B76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  XenoRat 1.0/Release/plugins/Uacbypass.dll
- Size 15KB
- SHA256 515866c35eae237aa0664e5447da2a58d2ed51726b8e2ce42e069a08a1ac467b
- MD5 e68c56589fcd6accfbfdbbb04e636413
- SHA1 de3708f2858667e6fdfd60dc56463c85fb143fec
- SHA512 173ef92f6373cb9e4090653494aa3edb9bee3a510243306441a2445c17c9560473a2dcc09652039a3e99c7ee8e99ed91d5b863066a229e4a1149f8dff3dab306
- SSDEEP 384:KYLXL+JSznydDFyfl69Wdecb2V/0MoViEBSAYn2K:KEYF6698b2xCBSAY5
- TLSH
  T16F62D8143BEC0627EA7F0DBD59E351878A79F7225C11EA1B09CC52871C62B44EA12FA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32