Extracted

• • Target

    00279cce20bb484f9ea1b89efc6be08e.exe

  • Size

    918KB

  • MD5

    00279cce20bb484f9ea1b89efc6be08e

  • SHA1

    da931ab637a622626fc2fb8a326fd6ccce931f66

  • SHA256

    877b28707372fb7365c52a314233c74877045cf1d8143fe83fb257f0bf90c248

  • SHA512

    f7c61894b3d07cfbd9ee4aaf2fecefd3096d28feb02c43a39cf809ab441b5a82c9ddb534992f1a0fc552d4eed1465a56782eeee73abc27ddb67c74b910d71508

  Score

  10^/10

  xpertratxxxevasionpersistencerattrojanupx

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core Payload

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Adds policy Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2