Overview

overview

10

Static

static

0530c72ac0...e8.exe

windows7_x64

10

0530c72ac0...e8.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0530c72ac087e821a13fd9173565dfe8.exe

  • Size

    28KB

  • Sample

    201111-fpjxnhgw36

  • MD5

    0530c72ac087e821a13fd9173565dfe8

  • SHA1

    a5a8ff2ee22dce4ec4d2d5674c29dc2483fb418e

  • SHA256

    d3f2094ff947212a812af1a551b602d9056843ae7f3bdf5f95c90e0590f9fb0a

  • SHA512

    72993dca21a351a1b7cfdf99cbf914ca0fe71437f250722f36c5da15ec8e80fca14143273fa5550fcc7ddf115d9b5749462ba304ba0f0faa441dd4901d917696

Score
10/10
xpertratspecial xevasionpersistencerattrojanupx

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

special X

C2

sandshoe.myfirewall.org:2054

sandshoe.myfirewall.org:4000
Mutex

C7H2A8R6-A3X1-J1N8-N887-L0I1C4O6U0D4

Targets

    • Target

      0530c72ac087e821a13fd9173565dfe8.exe

    • Size

      28KB

    • MD5

      0530c72ac087e821a13fd9173565dfe8

    • SHA1

      a5a8ff2ee22dce4ec4d2d5674c29dc2483fb418e

    • SHA256

      d3f2094ff947212a812af1a551b602d9056843ae7f3bdf5f95c90e0590f9fb0a

    • SHA512

      72993dca21a351a1b7cfdf99cbf914ca0fe71437f250722f36c5da15ec8e80fca14143273fa5550fcc7ddf115d9b5749462ba304ba0f0faa441dd4901d917696

    Score
    10/10
    xpertratspecial xevasionpersistencerattrojanupx

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • XpertRAT

      XpertRAT is a remote access trojan with various capabilities.

      ratxpertrat

    • XpertRAT Core Payload

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Adds policy Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

3
T1089

Modify Registry

6
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks