XenoRAT Info Stealer Execution

Daniel Jeremiah@daniyyell

•updated Jan 30, 2026•2•0•36

Detects execution of XenoRAT, an information stealer and remote access trojan targeting browser data, cryptocurrency wallets, file systems, and HVNC style remote desktop activity. Command and control parameters including hostname, port, username, and password are supplied at runtime. Detection uses known hashes and behavioural context, with higher confidence achieved by correlating with xenorat_stealer_file_access on the same host within 15 minutes.