Extracted

• • Target
    40e678e7d38a1541c06d16895d75f856.exe
  • Size 774KB
  • SHA256 7aa6ba1ed3e72514eac19d8b9ee4f95a17e33b63159bc75bd57ad8b38ce6361e
  • MD5 40e678e7d38a1541c06d16895d75f856
  • SHA1 5faee553c8dc1cc0492d7b8b78329ac56100c040
  • SHA512 4abce8638860dc80ec23516aba60cd1c87a66c8a98fb62730e042a8f78841afe45fd2c021f15395a06eb0b4b4e6a95809ce0d8d6806f95c2cc516caa7362be22
  • MD5 SHA1 SHA512

  Score

  10^/10

  xpertratxxxevasionpersistencerattrojan

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core Payload

  • Adds policy Run key to start application

    persistence

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2