xpertrat | 7aa6ba1ed3e72514eac19d8b9ee4f95a17e33b63159bc75bd57ad8b38ce6361e | Triage

Submit
Reports

Overview

overview

Static

static

40e678e7d3...56.exe

windows7_x64

40e678e7d3...56.exe

windows10_x64

Sharing

General

Target

40e678e7d38a1541c06d16895d75f856.exe
Size

774KB
Sample

210421-glv2eppk8e
MD5

40e678e7d38a1541c06d16895d75f856
SHA1

5faee553c8dc1cc0492d7b8b78329ac56100c040
SHA256

7aa6ba1ed3e72514eac19d8b9ee4f95a17e33b63159bc75bd57ad8b38ce6361e
SHA512

4abce8638860dc80ec23516aba60cd1c87a66c8a98fb62730e042a8f78841afe45fd2c021f15395a06eb0b4b4e6a95809ce0d8d6806f95c2cc516caa7362be22

Score

10^/10

xpertrat xxx evasion persistence rat trojan

Static task

static1

Behavioral task

behavioral1

Sample

40e678e7d38a1541c06d16895d75f856.exe

Resource

win7v20210408

xpertrat xxx evasion persistence rat trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

40e678e7d38a1541c06d16895d75f856.exe

Resource

win10v20210410

xpertrat xxx evasion persistence rat trojan

windows10_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

XXX

C2

kapasky-antivirus.firewall-gateway.net:2054

kapasky-antivirus.firewall-gateway.net:4000

Mutex

U4G3L113-M7Y0-X0M5-M3D5-U8C7U551Q8Q7

Targets

- Target
  
  40e678e7d38a1541c06d16895d75f856.exe
- Size
  
  774KB
- MD5
  
  40e678e7d38a1541c06d16895d75f856
- SHA1
  
  5faee553c8dc1cc0492d7b8b78329ac56100c040
- SHA256
  
  7aa6ba1ed3e72514eac19d8b9ee4f95a17e33b63159bc75bd57ad8b38ce6361e
- SHA512
  
  4abce8638860dc80ec23516aba60cd1c87a66c8a98fb62730e042a8f78841afe45fd2c021f15395a06eb0b4b4e6a95809ce0d8d6806f95c2cc516caa7362be22
Score

10^/10

xpertrat xxx evasion persistence rat trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- XpertRAT
  XpertRAT is a remote access trojan with various capabilities.
  rat xpertrat
- XpertRAT Core Payload
- Adds policy Run key to start application
  persistence
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

xpertratxxxevasionpersistencerattrojan

behavioral2

xpertratxxxevasionpersistencerattrojan

© 2018-2024

Terms | Privacy