XenoRAT UpdateWindowns a87cf095 -- xeno rat client String Tespiti, SharpDX DirectX Ekran Yakalama, Global 7B2A1-9D2E-4F3C Mutex, AddToStartupNonAdmin Kalicilik, localto.net Tunel Relay | Yuksek

Derin Analiz — XenoRAT | Tehdit: YUKSEK

Dosya Kimligi

SHA256	`a87cf0954145c8c8d0188af89ce197df0621f34e85ab7f7d78da808b124c8a07`
Boyut	378,880 byte (.NET PE32)
Isim	UpdateWindowns.exe (Windows typo luresi)
Timestamp	Future time (anti-analiz)

xeno rat client: String Tespiti

ONAY: xeno rat client stringi binary icinde x3 bulunuyor!

xeno rat client        (x3 referans)\nxeno rat client.exe    (x2 referans)\n\n-- XenoRAT: acik kaynak C# RAT (GitHub: moom825/xeno-rat)\n-- Costura ile DLL embed: SharpDX.Direct3D11, SharpDX.DXGI\n-- AddToStartupNonAdmin: admin olmadan startup kaydi\n-- Global\{7B2A1-9D2E-4F3C-8A11-B2C3D4E5F6G7} mutex

SharpDX DirectX Ekran Yakalama

SharpDX.Direct3D11.dll.compressed (283,136 byte)\nSharpDX.DXGI.dll.compressed (148,480 byte)\nSharpDX.dll.compressed (274,944 byte)\n\n-- DirectX 11 ile GPU-hizlandirmali ekran yakalama\n-- Standart GDI BitBlt yerine: daha hizli, AV tespiti daha zor\n-- SharpDX = .NET DirectX sarici\n-- DXGI: swap chain ile ekran icerigi al\n-- Kullanim: canli ekran izleme, uzaktan goruntuleme

localto.net: Tunel Relay

localto.net\n\n-- Localto.net: HTTP/TCP reverse tunnel servisi (ngrok benzeri)\n-- Operator kendi C2 IP adresini saklamak icin kullanir\n-- Kurban gelen baglanti: localto.net subdomain\n-- Subdomain arkasinda operator makinesi\n-- AV/Firewall: mesgul domain (localto.net) gorunce whitelist gecebilir\n-- XenoRAT operatoru konfigurasyona kendi localto.net subdomain giriyor

UpdateWindowns Lur Adi

"UpdateWindowns.exe"\n-- "Windowns" = Windows typo (Windows degil)\n-- Sahte Windows Update gibi gosterilmis\n-- Sosyal muhendislik: IT personeline veya kullaniciya "Windows guncelleme" diye sunulmus\n-- Future timestamp: zaman damgasi sahte (anti-analiz)

IOC

SHA256	`a87cf0954145c8c8d0188af89ce197df0621f34e85ab7f7d78da808b124c8a07`
Aile	XenoRAT (xeno rat client
Mutex	Global\{7B2A1-9D2E-4F3C-8A11-B2C3D4E5F6G7}
Relay	localto.net
Lur Adi	UpdateWindowns.exe

XenoRAT — Malware Profile

Open-source C# RAT (GitHub: moom825/xeno-rat). SharpDX DirectX screen capture. Costura embedded DLLs. AddToStartupNonAdmin persistence. Reverse tunnel via localto.net. Future timestamp anti-analysis. UpdateWindowns.exe typo lure.

Malware Type

RAT

Programming Language

C#/.NET

C2 Protocol

TCP/TLS

Target Systems

Küresel

Capabilities & Behavior

Uzaktan Erişim & Kontrol

Keylogger

Ekran Görüntüsü

Webcam Erişimi

Dosya Yönetimi

Süreç Yönetimi

Komut Yürütme

Kalıcılık Mekanizması

IOC List (1 indicators)

IOC — XenoRAT

# SHA256
a87cf0954145c8c8d0188af89ce197df0621f34e85ab7f7d78da808b124c8a07

Type	Value	Note
sha256	a87cf0954145c8c8d0188af89ce197df0621f34e85ab7f7d78da808b124c8a07

XenoRAT — Go to Full Profile →

C2 Servers (1 recorded servers for this family)

Address	Type	Port	Protocol	Status	Country
localto.net	domain	443	HTTPS	active	—

C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.