Extracted

Extracted

• • Target
    paymen_invoice.doc
  • Size 340KB
  • SHA256 e31f5bfd01e6d5876991d6aae68921b7510090d880d2602ed57032e7d14a9cae
  • MD5 285d05dd2a3a053e5095f09b609fca64
  • SHA1 668f3a6f6fa038bdbcd0e57d32783f37c259469d
  • SHA512 1db0f843078059020981aba55b5fe40d72ec5cc1aa0903353bde23e28299cfd732435760f80e7423c7b999e64e810090bfbaa2f90609aa426cd79074c655c407
  • MD5 SHA1 SHA512

  Score

  10^/10

  xpertrattestrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core Payload

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2