Extracted

• • Target

    85f0af15d708b6a2ea67a30f2a858efc9f32af678a5633289c297f588443cd7a

  • Size

    292KB

  • MD5

    f6200b9b9789794de4a8d78f4ae96d22

  • SHA1

    1d18c71e7e4de5c6216653db5effba586345597c

  • SHA256

    85f0af15d708b6a2ea67a30f2a858efc9f32af678a5633289c297f588443cd7a

  • SHA512

    5fd2e93293bf2ebe5b68e747dbed842c2f4fcd74dce883ffa7daa6daf647e41f4b1926fdf2f05048b3024609ef6805fb2a6b501c92335ab37098dfb6d4defa72

  Score

  10^/10

  xpertrattestevasionpersistencerattrojan

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core Payload

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Program crash

  • Suspicious use of SetThreadContext

  behavioral1