Overview

overview

10

Static

static

1

BBSEMXMXXX...15.exe

windows7_x64

10

BBSEMXMXXX...15.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BBSEMXMXXX01098210315.exe

  • Size

    222KB

  • Sample

    210315-8gkbbzwl8e

  • MD5

    7c6e6a3972fcd89ba074f78f27402531

  • SHA1

    46cd5b29880a457bd0a829ebb4a808e7d426eae2

  • SHA256

    3fa22ad54a485ad705fe5a71384a7002dedff621edfb81b4c4d71528407c879f

  • SHA512

    c55c275ff4fd4a43cf03dfc2de49da69baa439083e29257cf5447592bde51842a1c7b0877b44821f2f2221aae27473e5c7ee391c1baf452b9cba51f99634deb0

Score
10/10
xpertratwindows shealthevasionpersistencerattrojanupx

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

windows shealth

C2

79.134.225.77:7070

Mutex

C2H6Y3K1-A7X5-B5F3-N3W1-K4A558N0M337

Targets

    • Target

      BBSEMXMXXX01098210315.exe

    • Size

      222KB

    • MD5

      7c6e6a3972fcd89ba074f78f27402531

    • SHA1

      46cd5b29880a457bd0a829ebb4a808e7d426eae2

    • SHA256

      3fa22ad54a485ad705fe5a71384a7002dedff621edfb81b4c4d71528407c879f

    • SHA512

      c55c275ff4fd4a43cf03dfc2de49da69baa439083e29257cf5447592bde51842a1c7b0877b44821f2f2221aae27473e5c7ee391c1baf452b9cba51f99634deb0

    Score
    10/10
    xpertratwindows shealthevasionpersistencerattrojanupx

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • XpertRAT

      XpertRAT is a remote access trojan with various capabilities.

      ratxpertrat

    • XpertRAT Core Payload

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Adds policy Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Program crash

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

3
T1089

Modify Registry

6
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks