xpertrat | 3ec377ffc5814c66d3417104617bc3a048448ef400c360480efc036c425afb95 | Triage™

Login
Reports

Overview

overview

Static

static

SecuriteIn...58.exe

windows7_x64

SecuriteIn...58.exe

windows10-2004_x64

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.BackDoor.SpyBotNET.25.23558.4542
Size 667KB
Sample220414-pyf53ahabn
SHA256 3ec377ffc5814c66d3417104617bc3a048448ef400c360480efc036c425afb95
MD5 1ba1f5a8783628e45caad235c8f640cf
SHA1 b41e98059945ddb010d3b50e5d0c83ecdde79716
SHA512 75c8de68fad66ec3bc8bc8c4887ee561c4e8e8af3e41021213bad8ea06947f379adca14bd3c2fb3ca17f4ac4a17f6bcf5a4cc630fe9979b40b2f0a60efc2b4a9
MD5 SHA1 SHA512

Score

10^/10

xpertrat collection evasion persistence rat trojan

Static task

static1

Behavioral task

behavioral1

Sample

SecuriteInfo.com.BackDoor.SpyBotNET.25.23558.exe

Resource

win7-20220311-en

windows7_x64

0 signatures

0 seconds

xpertrat collection evasion persistence rat trojan

Behavioral task

behavioral2

Sample

SecuriteInfo.com.BackDoor.SpyBotNET.25.23558.exe

Resource

win10v2004-20220310-en

windows10-2004_x64

0 signatures

0 seconds

xpertrat collection evasion persistence rat trojan

Malware Config

Targets

- Target
  SecuriteInfo.com.BackDoor.SpyBotNET.25.23558.4542
- Size 667KB
- SHA256 3ec377ffc5814c66d3417104617bc3a048448ef400c360480efc036c425afb95
- MD5 1ba1f5a8783628e45caad235c8f640cf
- SHA1 b41e98059945ddb010d3b50e5d0c83ecdde79716
- SHA512 75c8de68fad66ec3bc8bc8c4887ee561c4e8e8af3e41021213bad8ea06947f379adca14bd3c2fb3ca17f4ac4a17f6bcf5a4cc630fe9979b40b2f0a60efc2b4a9
- MD5 SHA1 SHA512
Score

10^/10

xpertrat collection evasion persistence rat trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- XpertRAT
  XpertRAT is a remote access trojan with various capabilities.
  rat xpertrat
- Adds policy Run key to start application
  persistence
- Windows security modification
  evasion trojan
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Program crash
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xpertratcollectionevasionpersistencerattrojan

behavioral2

xpertratcollectionevasionpersistencerattrojan

© 2018-2026

Terms | Privacy