Extracted

• • Target

    DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe

  • Size

    686KB

  • MD5

    6ddea92be72b5543d108ec83b588297d

  • SHA1

    c13a41eb03b9e26fec3e6d6f6c1e273111729c03

  • SHA256

    ddde7cd1d82b5dee479ac17413690cedd04ad04ee14ae271d590da80e5a2a8bd

  • SHA512

    cc4771f3ee1d12f4610aa87f505f8616e5a35d1d541ed30a267b143ae7c683eb239477aa923493ed4db59dfb6a0d2c4c047d158a7bd4cbbe2b8e415281e80d93

  Score

  10^/10

  xpertrattestevasionpersistencerattrojan

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core Payload

  • Adds policy Run key to start application

    persistence

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2