Overview

overview

10

Static

static

66587368e3...79.exe

windows7_x64

10

66587368e3...79.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    66587368e39228edf1f6034794f17579.exe

  • Size

    419KB

  • Sample

    210625-pk4d2fbkzj

  • MD5

    66587368e39228edf1f6034794f17579

  • SHA1

    31268b1ac9bb83c698eadf5e74f65d58b12d2a50

  • SHA256

    b6b8326fd527390a435242178b6a45a973c4516d831669ce7527c5d97e90ab10

  • SHA512

    fdf02be618eb51fbdafa952b2eb60801d8448f0078c2127024ae2eb4d2542fdabad14bf0e5b127bea5c891a1986ed857032d1a519f3fc537e8296b7bb6a2d9f6

Score
10/10
xpertratspecial xevasionpersistencerattrojan

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

special X

C2

mertrerfeyy.duckdns.org:8494

gwtruwhgw.duckdns.org:8494

dfgrttuutii.duckdns.org:8494
Mutex

J0B4S3L1-T6W3-H2L6-N2T2-W4T8H1F1E6U4

Targets

    • Target

      66587368e39228edf1f6034794f17579.exe

    • Size

      419KB

    • MD5

      66587368e39228edf1f6034794f17579

    • SHA1

      31268b1ac9bb83c698eadf5e74f65d58b12d2a50

    • SHA256

      b6b8326fd527390a435242178b6a45a973c4516d831669ce7527c5d97e90ab10

    • SHA512

      fdf02be618eb51fbdafa952b2eb60801d8448f0078c2127024ae2eb4d2542fdabad14bf0e5b127bea5c891a1986ed857032d1a519f3fc537e8296b7bb6a2d9f6

    Score
    10/10
    xpertratspecial xevasionpersistencerattrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

3
T1089

Modify Registry

6
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks