MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9df32d691dc6483d47b40e6154aeff36f0acdc009c07b4af48618c4fb6b21b9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

XenoRAT

Vendor detections: 13

Intelligence 13 IOCs YARA 6 File information Comments

SHA256 hash:	9df32d691dc6483d47b40e6154aeff36f0acdc009c07b4af48618c4fb6b21b9f
SHA3-384 hash:	4cd5eff07f1f10f68eecf3c231f3737860ec260b27e74ff5d4e3fcc5c11dfbebcb7083c665f9f003755c1bb8281c84c3
SHA1 hash:	b89acc7669c5e84c1e5e9bcf0822df8803f10e43
MD5 hash:	7289b991c37d058b2e69b3983f75d122
humanhash:	mars-pip-ack-jig
File name:	SecuriteInfo.com.Win64.SpywareX-gen.4736.6522
Download:	download sample
Signature	XenoRAT Create hunting rule
File size:	510'976 bytes
First seen:	2025-02-15 13:08:28 UTC
Last seen:	2025-02-15 16:37:36 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	0b4d5639ff9364bba46be0997452ed6f (1 x XenoRAT)
ssdeep	12288:d7Wnj4mpB/33bxyy0vyJ2qiJSUINUpqag73a3Bkl:tyjVn/3LxavmzsINUpvg7
Threatray	5 similar samples on MalwareBazaar
TLSH	T100B48E56F19DC2F0F5B7DB3099B2224AD56B7C7556083E8B872C40AB2E93482CCE9F15
TrID	48.7% (.EXE) Win64 Executable (generic) (10522/11/4) 23.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.3% (.EXE) OS/2 Executable (generic) (2029/13) 9.2% (.EXE) Generic Win/DOS Executable (2002/3) 9.2% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	exe XenoRAT

Intelligence

File Origin

# of uploads :

# of downloads :

449

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Win64.SpywareX-gen.4736.6522.UNOFFICIAL

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67b0932e28ab76d43a5afe98

Tags:

shellcode virus

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Launching a process

Creating a file in the %temp% subdirectories

Сreating synchronization primitives

Creating a process from a recently created file

Creating a file

Unauthorized injection to a recently created process

Unauthorized injection to a system process

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/9df32d691dc6483d47b40e6154aeff36f0acdc009c07b4af48618c4fb6b21b9f

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

MoonPeak

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4db581fb-943f-4db7-89a5-fefbadcec4d9

Result

Threat name:

XenoRAT

Detection:

malicious

Classification:

troj.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/1615785

Signature

.NET source code contains potential unpacker

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found malware configuration

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Writes to foreign memory regions

Yara detected XenoRAT

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/9df32d691dc6483d47b40e6154aeff36f0acdc009c07b4af48618c4fb6b21b9f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9df32d691dc6483d47b40e6154aeff36f0acdc009c07b4af48618c4fb6b21b9f/

Threat name:

Win64.Backdoor.XenoRat

Status:

Malicious

First seen:

2025-02-15 07:28:34 UTC

File Type:

PE+ (Exe)

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=txzs22i5yzed2r5ubzqvjlx7g3ykzxaatqd3jl2imgge7nvsdopq._file

Verdict:

malicious

Label(s):

xenorat

XenoRAT

81e95eaca372c94265746b08aac50120c45e6baae7c521a8a23dd0dfdc3b9410

XenoRAT

9df32d691dc6483d47b40e6154aeff36f0acdc009c07b4af48618c4fb6b21b9f

XenoRAT

error

XenoRAT

Result

Malware family:

xenorat

Score:

10/10

Tags:

family:xenorat discovery rat trojan

Link:

https://tria.ge/reports/250215-qdvnds1pgj/

Behaviour

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Suspicious use of SetThreadContext

Executes dropped EXE

Loads dropped DLL

Downloads MZ/PE file

Detect XenoRat Payload

XenorRat

Xenorat family

Malware Config

C2 Extraction:

196.251.87.37

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/2aaf54c7-55db-462e-9a5a-4c5b8e3bc386

Unpacked files

SH256 hash:

9df32d691dc6483d47b40e6154aeff36f0acdc009c07b4af48618c4fb6b21b9f

MD5 hash:

7289b991c37d058b2e69b3983f75d122

SHA1 hash:

b89acc7669c5e84c1e5e9bcf0822df8803f10e43

Link:

https://www.unpac.me/results/b080f30e-8e2c-4e9c-85aa-f443a79e0c5c/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9df32d691dc6483d47b40e6154aeff36f0acdc009c07b4af48618c4fb6b21b9f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

XenoRAT

exe 9df32d691dc6483d47b40e6154aeff36f0acdc009c07b4af48618c4fb6b21b9f

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3440662/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CreateProcessA KERNEL32.dll::VirtualAllocEx KERNEL32.dll::WriteProcessMemory KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetCommandLineA KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::FreeConsole KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleOutputCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample