Spyware.XenoRAT malicious file

The Spyware.XenoRAT is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Spyware.XenoRAT virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine Spyware.XenoRAT?


File Info:
name: 039D1F0DC21CD752CAC6.mlw
path: /opt/CAPEv2/storage/binaries/c1b7f81f0d40e4ed6f31235f502792e1ae2c2866254bd492b302498377f0aac8
crc32: 7DFA93B6
md5: 039d1f0dc21cd752cac608434b205e3c
sha1: baacefeda4cbfd8e6adda01f25f2f52059805d76
sha256: c1b7f81f0d40e4ed6f31235f502792e1ae2c2866254bd492b302498377f0aac8
sha512: 4c2211a4d7b4110b3ba6f71105781140436ac57d1b191ef9a22d8adb37ba0fa1c2513fa28a336b29a62b7aaa7cad2295115da8e76fbf6da230cd25e9b1cb8383
ssdeep: 384:3ar3GmyvRMMCYLopROCM0jo/s1Vaxy5xa1EVALLPO6:3ar3GFJJ0pROCM0tVKOa+6PO6
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T1F852D78D877CD933ED3F6F7E69A5069307B6D260E912F65A0CDCB4E62CA2341840234E
sha3_384: 31a1d8365e0ecefbd07e863717f70166ca2922643ba7eb623b42e762219265554fc5720ccdbaa6404a2b18a317ee10e4
ep_bytes: ff250020001000000000000000000000
timestamp: 2056-09-08 21:29:32

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: ReverseProxy
FileVersion: 1.0.0.0
InternalName: ReverseProxy.dll
LegalCopyright: Copyright ©  2023
LegalTrademarks: 
OriginalFilename: ReverseProxy.dll
ProductName: ReverseProxy
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Spyware.XenoRAT also known as:

MicroWorld-eScan	Trojan.GenericKD.71878096
FireEye	Trojan.GenericKD.71878096
VIPRE	Trojan.GenericKD.71878096
Alibaba	Trojan:MSIL/XenoRAT.d2157fe3
K7GW	Trojan ( 005b27b81 )
ESET-NOD32	a variant of MSIL/XenoRAT.A
BitDefender	Trojan.GenericKD.71878096
Emsisoft	Trojan.GenericKD.71878096 (B)
F-Secure	Trojan.TR/Redcap.togxl
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.XenoRat
Avira	TR/Redcap.togxl
Antiy-AVL	Trojan/MSIL.XenoRAT
Arcabit	Trojan.Generic.D448C5D0
GData	Trojan.GenericKD.71878096
ALYac	Trojan.GenericKD.71878096
MAX	malware (ai score=83)
Malwarebytes	Spyware.XenoRAT
Fortinet	MSIL/XenoRAT.A!tr
DeepInstinct	MALICIOUS

How to remove Spyware.XenoRAT?

Spyware.XenoRAT removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X