Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
9 IOCs
Xenorat Malware Analysis/reports/xenorat En.md at Main · Yavuzhanzgen/xenorat Malware Analysis
Threat Actors
Excerpt
Yavuzhanzgen/XenoRAT-Malware-Analysis By Yavuzhanzgen Archived: 2026-10-09 02:01:32 UTC Legal Disclaimer https://github.com/Yavuzhanzgen/XenoRAT-Malware-Analysis/blob/main/Reports/XenoRAT_EN.md XenoRAT-Malware-Analysis/Reports/XenoRAT_EN.md at main · This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. Page 1 of 34…
Read the original report →Diamond Model
Adversary(6)
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →9 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | windirsluihelper.run | High | Score 67/100 | First seen |
| SHA256 | 868b6edee89aeee834a2d96d1534017b82304d3fbf33b07dd8d5d6184dea554e | High | Score 86/100 | First seen |
| Domain | fodhelper.run | High | Score 67/100 | First seen |
| IP | 1.0.0.0 | Low | Score 32/100 | First seen |
| Domain | messagebox.show | High | Score 67/100 | First seen |
| IP | 201.7.16.168 | High | Score 80/100 | First seen |
| MD5 | 86a967082cb9118c3271a925a53aa346 | High | Score 86/100 | First seen |
| Domain | aforge.video | High | Score 67/100 | First seen |
| Domain | cmstphelper.run | High | Score 67/100 | First seen |
IOC Relationship Graph
Building graph…