xpertrat | 829c6b6eb6cb26aca055fe65fd275a245bcae83836ef880246e85a58bda14e11 | Triage

Sharing

General

Target

829c6b6eb6cb26aca055fe65fd275a245bcae83836ef880246e85a58bda14e11
Size

708KB
Sample

220329-w67rbadgcl
MD5

5bd34ca98026e7b454a37ed430657b1b
SHA1

d15a28fbb03cd7fa999a0717ef53d23665d6c5ba
SHA256

829c6b6eb6cb26aca055fe65fd275a245bcae83836ef880246e85a58bda14e11
SHA512

cedcdb70999c63182600beda21fcb119f8510c9ec60d287a5b075b220070941bf078a265bd7b32cfd655a4a36fcbeb119c51760af5c0e923419bc23d796f2a07

Score

10^/10

xpertrat evasion persistence rat trojan

Malware Config

Targets

- Target
  
  829c6b6eb6cb26aca055fe65fd275a245bcae83836ef880246e85a58bda14e11
- Size
  
  708KB
- MD5
  
  5bd34ca98026e7b454a37ed430657b1b
- SHA1
  
  d15a28fbb03cd7fa999a0717ef53d23665d6c5ba
- SHA256
  
  829c6b6eb6cb26aca055fe65fd275a245bcae83836ef880246e85a58bda14e11
- SHA512
  
  cedcdb70999c63182600beda21fcb119f8510c9ec60d287a5b075b220070941bf078a265bd7b32cfd655a4a36fcbeb119c51760af5c0e923419bc23d796f2a07
Score

10^/10

xpertrat evasion persistence rat trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- XpertRAT
  XpertRAT is a remote access trojan with various capabilities.
  rat xpertrat
- Adds policy Run key to start application
  persistence
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xpertratevasionpersistencerattrojan

behavioral2

xpertratevasionpersistencerattrojan