Overview

overview

10

Static

static

63a7dd2640...a6.exe

windows7_x64

1

63a7dd2640...a6.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    63a7dd2640491df5075a08bf335545a6.exe

  • Size

    1.9MB

  • Sample

    210424-s7r34jmvln

  • MD5

    63a7dd2640491df5075a08bf335545a6

  • SHA1

    6bcdaa6627936d1c438d47016ad12ff018895fa6

  • SHA256

    5c32fd3de4bce60a2529cebc5f47b8a1562ea9bd22549f829b22b0533b32f79b

  • SHA512

    4e728c1d4d39efddc736c309fd5654cae0106ccaed8d40b9fc395a40576526e8e67afb6f974944c30ecf96476fe233aeeae56581d0647cb7d162ffbfeae0d756

Score
10/10
xpertratspecial xevasionpersistencerattrojan

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

special X

C2

ghytrty.duckdns.org:4145

spapertyy.duckdns.org:4145
Mutex

L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0

Targets

    • Target

      63a7dd2640491df5075a08bf335545a6.exe

    • Size

      1.9MB

    • MD5

      63a7dd2640491df5075a08bf335545a6

    • SHA1

      6bcdaa6627936d1c438d47016ad12ff018895fa6

    • SHA256

      5c32fd3de4bce60a2529cebc5f47b8a1562ea9bd22549f829b22b0533b32f79b

    • SHA512

      4e728c1d4d39efddc736c309fd5654cae0106ccaed8d40b9fc395a40576526e8e67afb6f974944c30ecf96476fe233aeeae56581d0647cb7d162ffbfeae0d756

    Score
    10/10
    xpertratspecial xevasionpersistencerattrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

3
T1089

Modify Registry

6
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks