xpertrat | f1c272538e67cbf0745b5c33f4c01e561ba358d56426214dad8c39167a8d92db | Triage

Sharing

General

Target

gunzipped.exe
Size

355KB
Sample

211223-khk2vshda9
MD5

1930ef3293c2754bd6ba9af70da667f6
SHA1

2264013df701a7f13eb36337990893f89fa14a05
SHA256

f1c272538e67cbf0745b5c33f4c01e561ba358d56426214dad8c39167a8d92db
SHA512

7ff34eadb9f0698d2b92c0435f0f74f9a5aa8d41d3d2c9afe59f0615e2c657e23ba1769b52129a7bc46f98aae3b9a9dff028f42cddc3de1e48f339ea63fb1638

Score

10^/10

xpertrat collection evasion persistence rat trojan

Malware Config

Targets

- Target
  
  gunzipped.exe
- Size
  
  355KB
- MD5
  
  1930ef3293c2754bd6ba9af70da667f6
- SHA1
  
  2264013df701a7f13eb36337990893f89fa14a05
- SHA256
  
  f1c272538e67cbf0745b5c33f4c01e561ba358d56426214dad8c39167a8d92db
- SHA512
  
  7ff34eadb9f0698d2b92c0435f0f74f9a5aa8d41d3d2c9afe59f0615e2c657e23ba1769b52129a7bc46f98aae3b9a9dff028f42cddc3de1e48f339ea63fb1638
Score

10^/10

xpertrat collection evasion persistence rat trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- XpertRAT
  XpertRAT is a remote access trojan with various capabilities.
  rat xpertrat
- Adds policy Run key to start application
  persistence
- Windows security modification
  evasion trojan
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Program crash
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xpertratcollectionevasionpersistencerattrojan

behavioral2

xpertratcollectionevasionpersistencerattrojan