Extracted

• • Target
    RFQ_PO_7645321875.exe
  • Size 261KB
  • SHA256 ff9d837e464eb07ad603c0b2ac0a35029117123c31570baeb61fca9a0242b493
  • MD5 870fdad769262715ea10aed9c9f724f4
  • SHA1 ddb6654c1a408fb8e55b3b1d8506e7d1e4d54d6d
  • SHA512 a0227797adcceb27e12c7ef49b9eaa4a9814d85136e35a162b589dd3eccf8339b62cbec3f924fcf0cf317a55d068d393d66363c20cd0fcac86c3c3ad43e9f63d
  • MD5 SHA1 SHA512

  Score

  10^/10

  xpertratspecial xevasionpersistencerattrojanupx

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core Payload

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Adds policy Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2