xpertrat | 515fbf67c103e796658acaf24ae3762943a56ebf14337ab46bf9e140f61da0f4 | Triage

Submit
Reports

Overview

overview

Static

static

d761f42a4d...1a.exe

windows7_x64

d761f42a4d...1a.exe

windows10_x64

3

Sharing

General

Target

d761f42a4df1938b43282d88e12c741a.exe
Size

12KB
Sample

210925-jycjzsage9
MD5

d761f42a4df1938b43282d88e12c741a
SHA1

fc1913d79b6f8c738bfdbb64cb99ac863ce42f05
SHA256

515fbf67c103e796658acaf24ae3762943a56ebf14337ab46bf9e140f61da0f4
SHA512

946cc5a7d60062ddc597b460f199dd28d35be42ab8092e5ad9a17e3dc31bdcf40ff4c875e5d44fc1896fdec28805edb3729edad36f2a3ae2d81d61f03379df24

Score

10^/10

xpertrat test evasion persistence rat trojan

Static task

static1

Behavioral task

behavioral1

Sample

d761f42a4df1938b43282d88e12c741a.exe

Resource

win7-en-20210920

xpertrat test evasion persistence rat trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

d761f42a4df1938b43282d88e12c741a.exe

Resource

win10v20210408

windows10_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

Test

C2

kapasky-antivirus.firewall-gateway.net:4000

Mutex

L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0

Targets

- Target
  
  d761f42a4df1938b43282d88e12c741a.exe
- Size
  
  12KB
- MD5
  
  d761f42a4df1938b43282d88e12c741a
- SHA1
  
  fc1913d79b6f8c738bfdbb64cb99ac863ce42f05
- SHA256
  
  515fbf67c103e796658acaf24ae3762943a56ebf14337ab46bf9e140f61da0f4
- SHA512
  
  946cc5a7d60062ddc597b460f199dd28d35be42ab8092e5ad9a17e3dc31bdcf40ff4c875e5d44fc1896fdec28805edb3729edad36f2a3ae2d81d61f03379df24
Score

10^/10

xpertrat test evasion persistence rat trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- XpertRAT
  XpertRAT is a remote access trojan with various capabilities.
  rat xpertrat
- XpertRAT Core Payload
- Adds policy Run key to start application
  persistence
- Deletes itself
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xpertrattestevasionpersistencerattrojan

behavioral2

© 2018-2024

Terms | Privacy