xpertrat | ca4c550b74e692f05bac96985ef41a10a13e4cb05977e58bd598480c5b0e2553 | Triage

Submit
Reports

Overview

overview

Static

static

8

ca4c550b74...53.exe

windows7_x64

7

ca4c550b74...53.exe

windows10_x64

Sharing

General

Target

ca4c550b74e692f05bac96985ef41a10a13e4cb05977e58bd598480c5b0e2553
Size

982KB
Sample

210513-4c2b1artsx
MD5

bc04f5148c8c07d10c8399f8730ead3b
SHA1

687400f2367176721b75a42805177120930d93dd
SHA256

ca4c550b74e692f05bac96985ef41a10a13e4cb05977e58bd598480c5b0e2553
SHA512

aad905a571c20eb29de4606c0e0e2ddc763d43c97fb706e84292effbdf2045f4f575813df0f5dad7071251973719b3baa8a82684044b24b9d1881f60834c69c1

Score

10^/10

xpertrat bad evasion persistence rat trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

ca4c550b74e692f05bac96985ef41a10a13e4cb05977e58bd598480c5b0e2553.exe

Resource

win7v20210410

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

ca4c550b74e692f05bac96985ef41a10a13e4cb05977e58bd598480c5b0e2553.exe

Resource

win10v20210410

xpertrat bad evasion persistence rat trojan

windows10_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

bad

C2

joeing.dnsfor.me:2011

Mutex

K8P3H007-I4G2-R2U0-V0F8-T1P2J5V771K5

Targets

- Target
  
  ca4c550b74e692f05bac96985ef41a10a13e4cb05977e58bd598480c5b0e2553
- Size
  
  982KB
- MD5
  
  bc04f5148c8c07d10c8399f8730ead3b
- SHA1
  
  687400f2367176721b75a42805177120930d93dd
- SHA256
  
  ca4c550b74e692f05bac96985ef41a10a13e4cb05977e58bd598480c5b0e2553
- SHA512
  
  aad905a571c20eb29de4606c0e0e2ddc763d43c97fb706e84292effbdf2045f4f575813df0f5dad7071251973719b3baa8a82684044b24b9d1881f60834c69c1
Score

10^/10

xpertrat bad evasion persistence rat trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- XpertRAT
  XpertRAT is a remote access trojan with various capabilities.
  rat xpertrat
- XpertRAT Core Payload
- Adds policy Run key to start application
  persistence
- Drops startup file
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

xpertratbadevasionpersistencerattrojan

© 2018-2024

Terms | Privacy