xpertrat | cec4e2234a72035a6c3f4144cccf9ec49f34f56a2a212981606f979be1b85adf | Triage

Sharing

General

Target

CPINV_DEC_02_0200202177199554_PY_2009545682211268563_Pdf.exe
Size

3.0MB
Sample

211203-hs8jssach6
MD5

22ad4f47ce82a255765f2e96b61d78c8
SHA1

c260d25d8e49d342d86a3231ff112b9707dc8d8a
SHA256

cec4e2234a72035a6c3f4144cccf9ec49f34f56a2a212981606f979be1b85adf
SHA512

6eca6d26d8809415c410ca2343adc221dca9c996de4f81fd3765dc53605eb4793b0c655deed31b011382352a7b69370df4eeb239fbcdc474e1d4c876db1328a3

Score

10^/10

xpertrat collection evasion persistence rat trojan

Malware Config

Targets

- Target
  
  CPINV_DEC_02_0200202177199554_PY_2009545682211268563_Pdf.exe
- Size
  
  3.0MB
- MD5
  
  22ad4f47ce82a255765f2e96b61d78c8
- SHA1
  
  c260d25d8e49d342d86a3231ff112b9707dc8d8a
- SHA256
  
  cec4e2234a72035a6c3f4144cccf9ec49f34f56a2a212981606f979be1b85adf
- SHA512
  
  6eca6d26d8809415c410ca2343adc221dca9c996de4f81fd3765dc53605eb4793b0c655deed31b011382352a7b69370df4eeb239fbcdc474e1d4c876db1328a3
Score

10^/10

xpertrat collection evasion persistence rat trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- XpertRAT
  XpertRAT is a remote access trojan with various capabilities.
  rat xpertrat
- Adds policy Run key to start application
  persistence
- Downloads MZ/PE file
- Windows security modification
  evasion trojan
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

xpertratcollectionevasionpersistencerattrojan

behavioral2

xpertratevasionpersistencerattrojan