xpertrat | e3c5d29533223d5a1cb39c9531bffce0bfbdae3b7335a8b203c034b581dda787 | Triage

Submit
Reports

Overview

overview

Static

static

4b448c2f70...96.exe

windows7_x64

4b448c2f70...96.exe

windows10_x64

Sharing

General

Target

4b448c2f70404c6b0dae7ee65bc2cd96.exe
Size

172KB
Sample

201225-al3v2wmcej
MD5

4b448c2f70404c6b0dae7ee65bc2cd96
SHA1

4d10fb4f0f2d092aabe75fefda6b1f8e5081dcb3
SHA256

e3c5d29533223d5a1cb39c9531bffce0bfbdae3b7335a8b203c034b581dda787
SHA512

1e97572d22809adaa684cbf0a2acba4e6f19c93c76937b8b2f45db890607036a712e90bf6250e85658589eddcdbb5fca55b37ebb2692979654a23c6d0fb38570

Score

10^/10

xpertrat special x evasion persistence rat trojan

Static task

static1

Behavioral task

behavioral1

Sample

4b448c2f70404c6b0dae7ee65bc2cd96.exe

Resource

win7v20201028

xpertrat special x evasion persistence rat trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

4b448c2f70404c6b0dae7ee65bc2cd96.exe

Resource

win10v20201028

xpertrat special x evasion persistence rat trojan

windows10_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

special X

C2

papertyy.duckdns.org:4145

ghytrty.duckdns.org:4145

Mutex

G7M3E0W6-E4D2-N1R0-S0C7-P1M2G5S6Y0H4

Targets

- Target
  
  4b448c2f70404c6b0dae7ee65bc2cd96.exe
- Size
  
  172KB
- MD5
  
  4b448c2f70404c6b0dae7ee65bc2cd96
- SHA1
  
  4d10fb4f0f2d092aabe75fefda6b1f8e5081dcb3
- SHA256
  
  e3c5d29533223d5a1cb39c9531bffce0bfbdae3b7335a8b203c034b581dda787
- SHA512
  
  1e97572d22809adaa684cbf0a2acba4e6f19c93c76937b8b2f45db890607036a712e90bf6250e85658589eddcdbb5fca55b37ebb2692979654a23c6d0fb38570
Score

10^/10

xpertrat special x evasion persistence rat trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- XpertRAT
  XpertRAT is a remote access trojan with various capabilities.
  rat xpertrat
- XpertRAT Core Payload
- Adds policy Run key to start application
  persistence
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

xpertratspecial xevasionpersistencerattrojan

behavioral2

xpertratspecial xevasionpersistencerattrojan

© 2018-2024

Terms | Privacy