Extracted

• • Target

    C202000000164556_pdf.exe

  • Size

    1.1MB

  • MD5

    672849391b8b92a05c59640f1765b3d0

  • SHA1

    4b46fb7e3b25d33b40f5894b0894f62f61a288b7

  • SHA256

    c675725093fc52813ef776f4c04acb080bcc017691987fd2c8db555911f6ab13

  • SHA512

    9fec40a262ba8f025c3c5560598f104ccea5f7a9f5b96074a99efe2f8f6ffdcc001bcd22cd4eb2f6ca776069b57cca1220efc6bf9676cadbf5fa9ec7e31d3bee

  Score

  10^/10

  xpertratxboxevasionpersistencerattrojanupx

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core Payload

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Adds policy Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Deletes itself

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2