Extracted

• • Target

    ee759b97c88356e23b04afa427c6cb94

  • Size

    172KB

  • MD5

    ee759b97c88356e23b04afa427c6cb94

  • SHA1

    439eba6c162e5512533ada4576de9f0e32def9d7

  • SHA256

    5c1fec4300276bd8bd042cf24f256de87350ad32a456578da4eb364de9f3fbfc

  • SHA512

    0447961f3ecfdfb5369cdd6f7bbc8d3455dcc8eaece606c85b9774f9c7981f26fea32133ea1c5214bbf73caea8c936257a1b349d2e7cee171f508ad1d4f050a0

  Score

  10^/10

  xpertratbxkevasionpersistencerattrojanupx

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core Payload

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Adds policy Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Program crash

  • Suspicious use of SetThreadContext

  behavioral1behavioral2