General

  • Target

    svchost.exe

  • Size

    776KB

  • Sample

    210709-mz86181mrj

  • MD5

    414ad28c17f6b49a2f825ffc49dbae02

  • SHA1

    43a194b57fbaab18ee206adb1d16690c887f0734

  • SHA256

    6b22261ef9a97fde0923ffe05c7aa8317fd3b0e27c10fbc967f9961a5f39c105

  • SHA512

    dde4855ebd23feb43c60e7dad21883867d97abe481dae2086933fc9f270d69a1ffe7506ba4e9b3c1a9ab93630fa6c9224a1d1918d8c6d77c47c4aad56823ffff

Malware Config

Extracted

Family

xpertrat

Version

3.1.9

Botnet

BXK

C2

ioxg.ix.tc:4000

Mutex

R4W8O5A3-P0G7-Q7U5-H114-L7S6L4U0I6I6

Targets

    • Target

      svchost.exe

    • Size

      776KB

    • MD5

      414ad28c17f6b49a2f825ffc49dbae02

    • SHA1

      43a194b57fbaab18ee206adb1d16690c887f0734

    • SHA256

      6b22261ef9a97fde0923ffe05c7aa8317fd3b0e27c10fbc967f9961a5f39c105

    • SHA512

      dde4855ebd23feb43c60e7dad21883867d97abe481dae2086933fc9f270d69a1ffe7506ba4e9b3c1a9ab93630fa6c9224a1d1918d8c6d77c47c4aad56823ffff

    • UAC bypass

    • Windows security bypass

    • XpertRAT

      XpertRAT is a remote access trojan with various capabilities.

    • XpertRAT Core Payload

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Adds policy Run key to start application

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Windows security modification

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Program crash

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks