Extracted

• • Target

    9b0315924b8b25d861199d276becfd34.exe

  • Size

    1.2MB

  • MD5

    9b0315924b8b25d861199d276becfd34

  • SHA1

    6f6dbce9332a844976698b75911c77afebb1543f

  • SHA256

    c109fdc9eebddd35215c226381a886b4f2fdec8956ac9cfc428cbb6ef3405777

  • SHA512

    b3528f7c4b0b3aa812e3b8113e7ee924f8ae34ab801c6a6cf20d56d30adba757f57041d8c6530cb6fc7c42a8b1894613ca54e0ceac0795e14dfa2a1e8ecf3d5d

  Score

  10^/10

  xpertratspecial xevasionpersistencerattrojanupx

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core Payload

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Adds policy Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Program crash

  • Suspicious use of SetThreadContext

  behavioral1behavioral2