Extracted

Extracted

• • Target
    SPECIFICATION-625636.doc
  • Size 341KB
  • SHA256 48accb18692df9774f22f810c1812ef3b3d0da6174406df8f9fb0840a513475f
  • MD5 7208a7b222996d4bc09ef1ff90f4e6fa
  • SHA1 8f64434a869f53831d34dd1ea1e2c6f599a8c978
  • SHA512 8aa072251243df640921fc05ea94dcc820f2aadf8e8d8215d7e01f4fff352f393fdf3065949cb84833d71ea46502904e35e77e9409353c46fa3518003e67d6cb
  • MD5 SHA1 SHA512

  Score

  10^/10

  xpertrattestevasionpersistencerattrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core Payload

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2