Skip to main content

XenoRAT

Malware Family

249 indicators of compromise attributed to XenoRAT across abuse.ch threat intelligence feeds.

Domains

2

IPs

7

URLs

0

Hashes

240

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&Cpayload

Sample indicators

IndicatorType
mask3dup-57114.portmap.hostdomain
porkera.ydns.eudomain
202.60.229.104ip
96.245.7.21ip
185.163.204.145ip
185.14.92.89ip
68.133.1.34ip
111.170.163.157ip
201.7.16.168ip
6d05d5e5310b31e26aaf54e7297f0f199056c92545c3b2602367dcdb67c761d0hash
91cfd0498b16d33890d8d4f4f1b69daaad5d703f898f46b811f73e92be19e5ffhash
e438002739eea9295f9f80b3d76fad809d95042ab695f20574e548a996ed9b0bhash
947bce97211371e730a2b8b79c2ec4d154904e8faa7bed2583c5c6c420230170hash
469aeffa2304a243bfa555589979bb3ccdb19f75842873805e7f522f15a87426hash
2e28b2860b0ebd2307d085370e3eb728f914c8fe37286cd089295955175465a5hash
4edcb51c961470638828b8f48a0259fb4b9645192f0b30e1d79b789c9b4c4d7fhash
f770b7e25d959f700c9119cb1d9a5ef444634a335ea9f230f06b51fdaa487ad1hash
bf11a0220b7cbe0f09af2e354d3858f9c50aacfd982260128fdf85f37f48ffb2hash
29295f7e090d0548a146ec1b9ed8b19235d65470e5580059c2ee99508ada3593hash
5a0886fc82bedd52f94509ce17092f6ea671e53622edf852cd7ba20901d25354hash
e3dd6a2ecf7a96725b12d66d7144c9ebf5c8578541433e87937bd801042b3498hash
c9ab3c4481da95348f1d65fecb8da349ecdb1826f16d27ee3e5c5a0d49384c52hash
cb5e0d435fbad026262192e4ded328eba2952f35433412cba4d494a2d8661ca5hash
bd96ab832522b95bc01637c0aa4d2a03cb9a36c1ace05ce6c0962586d3fd645fhash
e6ff193f9686d5dd8cd1a7fe572e81165a97ed0d3898a5207117cdb382613821hash
5e84212896be25f411d5185406286fe5ee898afe757623a6acbf736c20c3e838hash
15ad522ec1e3313921cb6d311a87bca109ac311a3bfd416019fe64a7c60b3dc1hash
4f73762586d251a63e83fdf4d759d241be6cc6b0b9be84c2c63c78546a64a392hash
fe67e626cec1bf31f177cc74846bea404f819c24a873a9c17ad4ee921d579492hash

Another file to check? Run a file hash reputation check.