xpertrat | 25a80f4addf74c82d8ae815164c44dcd530fd59fc278f306552d35d5140b880b | Triage™

Login
Reports

Overview

overview

Static

static

CS-SUPPLIE...B).exe

windows7_x64

CS-SUPPLIE...B).exe

windows10-2004_x64

Sharing

Copy URL Twitter E-mail

General

Target
CS-SUPPLIER QUOTATION SPECIFICATION 2022-0120 45PCS.PDF(97KB).exe
Size 380KB
Sample220120-jbv3taggd4
SHA256 25a80f4addf74c82d8ae815164c44dcd530fd59fc278f306552d35d5140b880b
MD5 1402bc75caa465e3c69c302a7390a8e7
SHA1 df94f132f82c48cdda43a1121266320a1520ffdc
SHA512 5fc4fe7216c19ae454bf681a53bf0a573a4aed13ca2d596c2c361b4390cffe4b232887e32c1bbf75b6d770100e4878a88b7fea564c7efee211bf80c763f0bcc2
MD5 SHA1 SHA512

Score

10^/10

xpertrat collection evasion persistence rat trojan

Static task

static1

Behavioral task

behavioral1

Sample

CS-SUPPLIER QUOTATION SPECIFICATION 2022-0120 45PCS.PDF(97KB).exe

Resource

win7-en-20211208

windows7_x64

0 signatures

0 seconds

xpertrat collection evasion persistence rat trojan

Behavioral task

behavioral2

Sample

CS-SUPPLIER QUOTATION SPECIFICATION 2022-0120 45PCS.PDF(97KB).exe

Resource

win10v2004-en-20220112

windows10-2004_x64

0 signatures

0 seconds

xpertrat collection evasion persistence rat trojan

Malware Config

Targets

- Target
  CS-SUPPLIER QUOTATION SPECIFICATION 2022-0120 45PCS.PDF(97KB).exe
- Size 380KB
- SHA256 25a80f4addf74c82d8ae815164c44dcd530fd59fc278f306552d35d5140b880b
- MD5 1402bc75caa465e3c69c302a7390a8e7
- SHA1 df94f132f82c48cdda43a1121266320a1520ffdc
- SHA512 5fc4fe7216c19ae454bf681a53bf0a573a4aed13ca2d596c2c361b4390cffe4b232887e32c1bbf75b6d770100e4878a88b7fea564c7efee211bf80c763f0bcc2
- MD5 SHA1 SHA512
Score

10^/10

xpertrat collection evasion persistence rat trojan
- Suspicious use of NtCreateProcessExOtherParentProcess
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- XpertRAT
  XpertRAT is a remote access trojan with various capabilities.
  rat xpertrat
- Adds policy Run key to start application
  persistence
- Sets service image path in registry
  persistence
- Windows security modification
  evasion trojan
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Program crash
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xpertratcollectionevasionpersistencerattrojan

behavioral2

xpertratcollectionevasionpersistencerattrojan

© 2018-2026

Terms | Privacy