xpertrat | 5183105aacaf926e7358ff33a1503e58d712a9fc97800bbe8e26132284acb414 | Triage

Submit
Reports

Overview

overview

Static

static

SecuriteIn...62.exe

windows7_x64

SecuriteIn...62.exe

windows10_x64

Sharing

General

Target

SecuriteInfo.com.Trojan.Siggen10.31344.29315.6962
Size

932KB
Sample

201008-zrh3wzxxc2
MD5

ff05aef9ab76c8f7c5983a2ce3d4e02d
SHA1

953459a3a1e598c1d7c28f5a2e52b7c982bc904b
SHA256

5183105aacaf926e7358ff33a1503e58d712a9fc97800bbe8e26132284acb414
SHA512

b9749ae87e74ac1f591e1fb2eca66dba4f7ee2836424de28c92fd9bed5a85408b1ea7c483e4793c4f50d823ba1dd6ddd60e321d201f31c3388c411aec65903b2

Score

10^/10

xpertrat xbox evasion persistence rat trojan

Static task

static1

Behavioral task

behavioral1

Sample

SecuriteInfo.com.Trojan.Siggen10.31344.29315.6962.exe

Resource

win7

xpertrat xbox evasion persistence rat trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

SecuriteInfo.com.Trojan.Siggen10.31344.29315.6962.exe

Resource

win10v200722

xpertrat xbox evasion persistence rat trojan

windows10_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

xbox

C2

91.193.75.200:4726

79.134.225.97:4726

Mutex

P4U8N5X3-N0E7-P7T5-M113-K7R6K4S0G6G6

Targets

- Target
  
  SecuriteInfo.com.Trojan.Siggen10.31344.29315.6962
- Size
  
  932KB
- MD5
  
  ff05aef9ab76c8f7c5983a2ce3d4e02d
- SHA1
  
  953459a3a1e598c1d7c28f5a2e52b7c982bc904b
- SHA256
  
  5183105aacaf926e7358ff33a1503e58d712a9fc97800bbe8e26132284acb414
- SHA512
  
  b9749ae87e74ac1f591e1fb2eca66dba4f7ee2836424de28c92fd9bed5a85408b1ea7c483e4793c4f50d823ba1dd6ddd60e321d201f31c3388c411aec65903b2
Score

10^/10

xpertrat xbox evasion persistence rat trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- XpertRAT
  XpertRAT is a remote access trojan with various capabilities.
  rat xpertrat
- XpertRAT Core Payload
- Adds policy Run key to start application
  persistence
- Deletes itself
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Modify Registry

Disabling Security Tools

Bypass User Account Control

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

xpertratxboxevasionpersistencerattrojan

behavioral2

xpertratxboxevasionpersistencerattrojan

© 2018-2024

Terms | Privacy