Extracted

• • Target

    RFQ 13970 DT.exe

  • Size

    536KB

  • MD5

    7fdc62d82d767e18af6869c620a52cd1

  • SHA1

    b9943156ba008c49589df08a936f213ecdf52729

  • SHA256

    276963ec4efb403c18a96f94786c7b9f775a1bb22169636d8f594241288df9d3

  • SHA512

    10d516a75e3805268f28ddb4d86ecd438bb9f7823797112d55470f13c7286b91141d43c251cb04fff7d1090ef954d3b4d1fa264c28b6d930da60045ab977773b

  Score

  10^/10

  xpertratmsnevasionpersistenceratrezer0trojan

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core Payload

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Adds policy Run key to start application

    persistence

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2