xpertrat | 5bdc764598795f4afcb70f6ff95f29114f61ea24a1d836838125c08268e13de9 | Triage

Submit
Reports

Overview

overview

Static

static

dridex

windows10_x64

Sharing

General

Target

5bdc764598795f4afcb70f6ff95f29114f61ea24a1d836838125c08268e13de9
Size

12KB
Sample

211004-jw6p2sgahm
MD5

2cb032be3ffbf1a86e75669f6ff3e088
SHA1

bd801dff881983fad20212b5ee5cb7cc65845bf5
SHA256

5bdc764598795f4afcb70f6ff95f29114f61ea24a1d836838125c08268e13de9
SHA512

1d0cae94138772ffb87823012e88631ae531720aa0225e30cf298ed0b2326c17c41c64edd9002026eef552a91664edcfcce69b0d3480e44e21b95e7fc7158726

Score

10^/10

xpertrat test evasion persistence rat trojan

Static task

static1

Behavioral task

behavioral1

Sample

5bdc764598795f4afcb70f6ff95f29114f61ea24a1d836838125c08268e13de9.exe

Resource

win10v20210408

xpertrat test evasion persistence rat trojan

windows10_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

Test

C2

kapasky-antivirus.firewall-gateway.net:4000

Mutex

L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0

Targets

- Target
  
  5bdc764598795f4afcb70f6ff95f29114f61ea24a1d836838125c08268e13de9
- Size
  
  12KB
- MD5
  
  2cb032be3ffbf1a86e75669f6ff3e088
- SHA1
  
  bd801dff881983fad20212b5ee5cb7cc65845bf5
- SHA256
  
  5bdc764598795f4afcb70f6ff95f29114f61ea24a1d836838125c08268e13de9
- SHA512
  
  1d0cae94138772ffb87823012e88631ae531720aa0225e30cf298ed0b2326c17c41c64edd9002026eef552a91664edcfcce69b0d3480e44e21b95e7fc7158726
Score

10^/10

xpertrat test evasion persistence rat trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- XpertRAT
  XpertRAT is a remote access trojan with various capabilities.
  rat xpertrat
- XpertRAT Core Payload
- Adds policy Run key to start application
  persistence
- Deletes itself
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xpertrattestevasionpersistencerattrojan

© 2018-2024

Terms | Privacy