MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1d7b0211ea0939519cc08b95065f17f0d939e150539e2e1c87eeac1ec1433da5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

XenoRAT

Vendor detections: 16

Intelligence 16 IOCs YARA 10 File information Comments 1

SHA256 hash:	1d7b0211ea0939519cc08b95065f17f0d939e150539e2e1c87eeac1ec1433da5
SHA3-384 hash:	06a3bb24f8367468785c04846df2d6cdca4c7a89d7cd90f4dc547065b0d29f9d3c6b3b9a5587beeab642c5ea03e94732
SHA1 hash:	f8e23331c6139ef73f95cf90b35c70e726c7e0af
MD5 hash:	41c3396a0cc2b997f7cc91b82c3ee4f4
humanhash:	zebra-yankee-pennsylvania-september
File name:	1d7b0211ea0939519cc08b95065f17f0d939e150539e2e1c87eeac1ec1433da5.exe
Download:	download sample
Signature	XenoRAT Create hunting rule
File size:	47'104 bytes
First seen:	2025-04-16 03:57:30 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'672 x AgentTesla, 19'494 x Formbook, 12'214 x SnakeKeylogger)
ssdeep	768:YdhO/poiiUcjlJInFFH9Xqk5nWEZ5SbTDajWI7CPW5x:Kw+jjgnbH9XqcnW85SbTCWIJ
TLSH	T11A23E84C5B6D8923F6AF1ABD9432429387B3E227A532E38F48CCD4E9379338545453A3
TrID	58.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 13.2% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 8.4% (.EXE) Win64 Executable (generic) (10522/11/4) 5.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
Reporter	JAMESWT_WT
Tags:	191-96-166-73 exe XenoRAT

Intelligence

File Origin

# of uploads :

# of downloads :

474

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

1d7b0211ea0939519cc08b95065f17f0d939e150539e2e1c87eeac1ec1433da5.exe

Verdict:

Malicious activity

Analysis date:

2025-04-16 04:01:58 UTC

Tags:

xenorat rat remote

Link:

https://app.any.run/tasks/dfb77e4d-ddaf-4239-aee5-7d71a96c8b78

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

XenoRAT

Link:

https://www.capesandbox.com/analysis/2395/

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67ff3fc2954c9c53de0b7739

Tags:

netwiredrc backdoor netwire virus

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Connection attempt

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-vm cmd lolbin obfuscated reconnaissance schtasks

Link:

https://www.filescan.io/uploads/67ff2ad1931404048d7f62b4/reports/14c39ac8-73b6-4915-bf64-adf85041d71c/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/1d7b0211ea0939519cc08b95065f17f0d939e150539e2e1c87eeac1ec1433da5

Malware family:

MoonPeak

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/cd7f3b39-c465-45d5-8873-a6c7611b2756

Result

Threat name:

XenoRAT

Detection:

malicious

Classification:

troj.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1666012

Signature

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Found malware configuration

Found potential dummy code loops (likely to delay analysis)

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XenoRAT

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/1d7b0211ea0939519cc08b95065f17f0d939e150539e2e1c87eeac1ec1433da5

Detection:

xenorat

Link:

https://mwdb.cert.pl/sample/1d7b0211ea0939519cc08b95065f17f0d939e150539e2e1c87eeac1ec1433da5/

Threat name:

ByteCode-MSIL.Backdoor.XenoRAT

Status:

Malicious

First seen:

2025-04-13 06:08:20 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

22 of 24 (91.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dv5qeepkbe4vdhgarokqmxyx6dmttykqkopc4heh52wb5qkdhwsq._file

Verdict:

malicious

Label(s):

moonpeak

Similar samples:

error

XenoRAT

Result

Malware family:

xenorat

Score:

10/10

Tags:

family:xenorat discovery rat trojan

Link:

https://tria.ge/reports/250416-ejjyassqt7/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

System Location Discovery: System Language Discovery

Detect XenoRat Payload

XenorRat

Xenorat family

Malware Config

C2 Extraction:

191.96.166.73

Verdict:

Malicious

Tags:

Win.Malware.Msilzilla-10023780-0 xenorat

YARA:

n/a

Link:

https://app.threat.zone/submission/e93bd762-947b-433f-a2f5-8276f26f7ca2

Unpacked files

SH256 hash:

1d7b0211ea0939519cc08b95065f17f0d939e150539e2e1c87eeac1ec1433da5

MD5 hash:

41c3396a0cc2b997f7cc91b82c3ee4f4

SHA1 hash:

f8e23331c6139ef73f95cf90b35c70e726c7e0af

Detections:

win_xenorat_w0

XenoRAT

Link:

https://www.unpac.me/results/4932836a-bb09-4772-b428-e6d85ac53a57/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MALWARE_Win_XenoRAT Create hunting rule
Author:	ditekshen
Description:	Detects Blacksuit

Rule name:	Multifamily_RAT_Detection Create hunting rule
Author:	Lucas Acha (http://www.lukeacha.com)
Description:	Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Windows_Trojan_Xeno_f92ffb82 Create hunting rule
Author:	Elastic Security

Rule name:	win_xenorat_w0 Create hunting rule
Author:	jeFF0Falltrades
Description:	Detects win.xenorat.

Rule name:	xenorat Create hunting rule
Author:	jeFF0Falltrades

Rule name:	xeno_rat Create hunting rule
Author:	Nikolaos 'n0t' Totosis
Description:	Xeno Rat Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/2395/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

commented on 2025-04-16 04:01:11 UTC

RAT King Parser (https://github.com/jeFF0Falltrades/rat_king_parser) Output:

{
"sha256": "1d7b0211ea0939519cc08b95065f17f0d939e150539e2e1c87eeac1ec1433da5",
"yara_possible_family": "xenorat",
"key": "650f47cdd14eaef8c529f2a03fa7744c",
"salt": "None",
"config": {
"Hosts": [
"191.96.166.73"
],
"Ports": 5000,
"Key": "03ac674216f3e15c761ee1a5e255f067953623c8b388b4459e13f978d7c846f4",
"delay": 5000,
"mutexstring": "Xeno_rat_nd8912d",
"DoStartup": 2222,
"Installpath": "nothingset",
"startupname": "nothingset"
}
}