Extracted

• • Target

    1f609ed72b74f23379e8d7636b5faa13.exe

  • Size

    25KB

  • MD5

    1f609ed72b74f23379e8d7636b5faa13

  • SHA1

    439d50691f585b1a3cd674a0852834a97d9fc9cb

  • SHA256

    29a4c9380a91012be5a2b3659f9a4c46d0eca15c689a95707f78ccde9cd11f02

  • SHA512

    15eb37df42c5747aad644844b7ed3a7da98855e443e5293a64ebf092025e9210e99dbc7889c92854bcbfbf1840004a6c0b2c086a20d6a968f22354f0cd1161b4

  Score

  10^/10

  xpertratspecial xevasionpersistencerattrojan

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core Payload

  • Adds policy Run key to start application

    persistence

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2