Extracted

• • Target

    80099d016219e9682b1e217586f5cad1.exe

  • Size

    735KB

  • MD5

    80099d016219e9682b1e217586f5cad1

  • SHA1

    1628b91051a35e7cb70fe58e2b6e9ac135e1815c

  • SHA256

    d7f2fddb43eb63f9246f0a4535dfcca6da2817592455d7eceaacde666cf1aaae

  • SHA512

    82faf680912e72f2e1b25288be9f13f1722be79f5cf4c04c46342f02a85afb2e76f1bec8f4beb729d96c802fe8b0b205ac4f133331eafccc07a4a91a18edb649

  Score

  10^/10

  xpertratbxkevasionpersistencerattrojan

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core Payload

  • Adds policy Run key to start application

    persistence

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2