MALWARE FAMILY

XenoRAT

Internal ID: win.xenorat

aliases

Last seen:Mar 17, 2026

Intelligence Profile

XenoRAT is an open source remote access trojan written in C#. It can monitor user activity including keystrokes, and provide remote control over the compromised system.

Threat Analysis

XenoRAT is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://axmahr.github.io/posts/xenorat-detection/

→https://blog.talosintelligence.com/moonpeak-malware-infrastructure-north-korea/

→https://github.com/moom825/xeno-rat

→https://hunt.io/blog/good-game-gone-bad-xeno-rat-spread-via-gg-domains-and-github

→https://hunt.io/blog/xenorat-excel-xll-confuserex-as-access-method

→https://www.cyfirma.com/research/xeno-rat-a-new-remote-access-trojan-with-advance-capabilities/

→https://www.seqrite.com/blog/goodbye-hta-hello-msi-new-ttps-and-clusters-of-an-apt-driven-by-multi-platform-attacks/

→https://www.trellix.com/blogs/research/dprk-linked-github-c2-espionage-campaign/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.xenorat

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search XenoRAT