Extracted

• • Target

    fed0dec9c86e3f1057e7cf1c7eb22c8d528da1f6a966de89587b41f7b78e2f98.bin

  • Size

    358KB

  • MD5

    d952cb0acf14545d0e6da5509db9088d

  • SHA1

    9e4c5b31c821cc46f8eba61d65442f0bdbe67b98

  • SHA256

    fed0dec9c86e3f1057e7cf1c7eb22c8d528da1f6a966de89587b41f7b78e2f98

  • SHA512

    e66869cc859af82d4ad9db0c877d949905e3f28876e1022f434083e6f26492e3edac72624ce3143ca85446f4bce7ed208e41f846c5bcb13af7343047c7df8ebc

  Score

  10^/10

  xpertrattestevasionpersistencerattrojan

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core Payload

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Program crash

  • Suspicious use of SetThreadContext

  behavioral1behavioral2