General
-
Target
1f609ed72b74f23379e8d7636b5faa13.exe
-
Size
25KB
-
Sample
210425-nh1rh84pgj
-
MD5
1f609ed72b74f23379e8d7636b5faa13
-
SHA1
439d50691f585b1a3cd674a0852834a97d9fc9cb
-
SHA256
29a4c9380a91012be5a2b3659f9a4c46d0eca15c689a95707f78ccde9cd11f02
-
SHA512
15eb37df42c5747aad644844b7ed3a7da98855e443e5293a64ebf092025e9210e99dbc7889c92854bcbfbf1840004a6c0b2c086a20d6a968f22354f0cd1161b4
Static task
static1
Behavioral task
behavioral1
Sample
1f609ed72b74f23379e8d7636b5faa13.exe
Resource
win7v20210410
Malware Config
Extracted
xpertrat
3.0.10
special X
ghytrty.duckdns.org:4145
spapertyy.duckdns.org:4145
L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0
Targets
-
-
Target
1f609ed72b74f23379e8d7636b5faa13.exe
-
Size
25KB
-
MD5
1f609ed72b74f23379e8d7636b5faa13
-
SHA1
439d50691f585b1a3cd674a0852834a97d9fc9cb
-
SHA256
29a4c9380a91012be5a2b3659f9a4c46d0eca15c689a95707f78ccde9cd11f02
-
SHA512
15eb37df42c5747aad644844b7ed3a7da98855e443e5293a64ebf092025e9210e99dbc7889c92854bcbfbf1840004a6c0b2c086a20d6a968f22354f0cd1161b4
-
XpertRAT Core Payload
-
Adds policy Run key to start application
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-