xpertrat | 467693bbef8580dd6eab668a628d44e94548710be1cc60799f8e17df8c63f88a | Triage

Sharing

General

Target

467693bbef8580dd6eab668a628d44e94548710be1cc60799f8e17df8c63f88a.exe
Size

424KB
Sample

211222-w213zafha7
MD5

4f5e20c314951e30f5ca01a71559a62c
SHA1

8910f34119c522fed7dee3f545ed7aa67396baec
SHA256

467693bbef8580dd6eab668a628d44e94548710be1cc60799f8e17df8c63f88a
SHA512

e39657f0dbab0cf9056e41d753e8c26e83b4d2b23cafedbb3652e588bf248f538c1fa1ed6017c4cee5bfde8304cb6d1b521bc12191547321195f0578e160f012

Score

10^/10

xpertrat collection evasion persistence rat trojan

Malware Config

Targets

- Target
  
  467693bbef8580dd6eab668a628d44e94548710be1cc60799f8e17df8c63f88a.exe
- Size
  
  424KB
- MD5
  
  4f5e20c314951e30f5ca01a71559a62c
- SHA1
  
  8910f34119c522fed7dee3f545ed7aa67396baec
- SHA256
  
  467693bbef8580dd6eab668a628d44e94548710be1cc60799f8e17df8c63f88a
- SHA512
  
  e39657f0dbab0cf9056e41d753e8c26e83b4d2b23cafedbb3652e588bf248f538c1fa1ed6017c4cee5bfde8304cb6d1b521bc12191547321195f0578e160f012
Score

10^/10

xpertrat collection evasion persistence rat trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- XpertRAT
  XpertRAT is a remote access trojan with various capabilities.
  rat xpertrat
- Adds policy Run key to start application
  persistence
- Windows security modification
  evasion trojan
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Program crash
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

xpertratcollectionevasionpersistencerattrojan

behavioral2

xpertratcollectionevasionpersistencerattrojan