Overview

overview

10

Static

static

9b0315924b...34.exe

windows7_x64

1

9b0315924b...34.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9b0315924b8b25d861199d276becfd34.exe

  • Size

    1.2MB

  • Sample

    210629-r3nnd492t6

  • MD5

    9b0315924b8b25d861199d276becfd34

  • SHA1

    6f6dbce9332a844976698b75911c77afebb1543f

  • SHA256

    c109fdc9eebddd35215c226381a886b4f2fdec8956ac9cfc428cbb6ef3405777

  • SHA512

    b3528f7c4b0b3aa812e3b8113e7ee924f8ae34ab801c6a6cf20d56d30adba757f57041d8c6530cb6fc7c42a8b1894613ca54e0ceac0795e14dfa2a1e8ecf3d5d

Score
10/10
xpertratspecial xevasionpersistencerattrojanupx

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

special X

C2

mertrerfeyy.duckdns.org:8494

gwtruwhgw.duckdns.org:8494

dfgrttuutii.duckdns.org:8494
Mutex

J0B4S3L1-T6W3-H2L6-N2T2-W4T8H1F1E6U4

Targets

    • Target

      9b0315924b8b25d861199d276becfd34.exe

    • Size

      1.2MB

    • MD5

      9b0315924b8b25d861199d276becfd34

    • SHA1

      6f6dbce9332a844976698b75911c77afebb1543f

    • SHA256

      c109fdc9eebddd35215c226381a886b4f2fdec8956ac9cfc428cbb6ef3405777

    • SHA512

      b3528f7c4b0b3aa812e3b8113e7ee924f8ae34ab801c6a6cf20d56d30adba757f57041d8c6530cb6fc7c42a8b1894613ca54e0ceac0795e14dfa2a1e8ecf3d5d

    Score
    10/10
    xpertratspecial xevasionpersistencerattrojanupx

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • XpertRAT

      XpertRAT is a remote access trojan with various capabilities.

      ratxpertrat

    • XpertRAT Core Payload

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Adds policy Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

3
T1089

Modify Registry

6
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks