Overview

overview

10

Static

static

ExpertRat.exe

windows7_x64

10

ExpertRat.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ExpertRat

  • Size

    805KB

  • Sample

    200908-1lzh9l67ce

  • MD5

    0ca753d4699587ff19e0cd5719edaff8

  • SHA1

    d465c0b0f0d4aef7da057dcf5a9eefe5cf7e62ee

  • SHA256

    08927d7955b1be7fd05d81a73057242117540094dda7cca1c162f3aea18c2854

  • SHA512

    ba14ad1651c7b4aefcdec9096312c1ede3c9d11c82393d24c066da74d55f8a059be4ce3dcc1013fb0f06741cb1e2e8346d72860cf8d81214e9a0328ea7894567

Score
10/10
xpertratwinevasionpersistencerattrojanupx

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

win

C2

91.193.75.200:4726

Mutex

N3S7K4V2-L8C6-M6Q5-Y5I3-V6L7F1Y2X5G0

Targets

    • Target

      ExpertRat

    • Size

      805KB

    • MD5

      0ca753d4699587ff19e0cd5719edaff8

    • SHA1

      d465c0b0f0d4aef7da057dcf5a9eefe5cf7e62ee

    • SHA256

      08927d7955b1be7fd05d81a73057242117540094dda7cca1c162f3aea18c2854

    • SHA512

      ba14ad1651c7b4aefcdec9096312c1ede3c9d11c82393d24c066da74d55f8a059be4ce3dcc1013fb0f06741cb1e2e8346d72860cf8d81214e9a0328ea7894567

    Score
    10/10
    xpertratwinevasionpersistencerattrojanupx

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • XpertRAT

      XpertRAT is a remote access trojan with various capabilities.

      ratxpertrat

    • XpertRAT Core Payload

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Adds policy Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Program crash

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Modify Registry

7
T1112

Disabling Security Tools

4
T1089

Bypass User Account Control

1
T1088

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks