xpertrat | 5f55d8c4830b28a08183d87428064f6a641f7c95ffe373cafe1ecb8b36043d99 | Triage

Sharing

General

Target

SecuriteInfo.com.BackDoor.SpyBotNET.25.4997.4827
Size

687KB
Sample

220414-t61a5aged3
MD5

dd7de3e242afd0dbd6166879237df822
SHA1

3a4fb913f82082633f6130f12c28fa10b53db91e
SHA256

5f55d8c4830b28a08183d87428064f6a641f7c95ffe373cafe1ecb8b36043d99
SHA512

2c853287bddd0156f486ec8e7f36ee8d4a1f2e47b43c9a4f126e980546ce4359de7f7c1bfd2db1133cdfa5b99e64587b9e1f85898fc1eb95ac3d7b4161a181dc

Score

10^/10

xpertrat collection evasion persistence rat trojan

Malware Config

Targets

- Target
  
  SecuriteInfo.com.BackDoor.SpyBotNET.25.4997.4827
- Size
  
  687KB
- MD5
  
  dd7de3e242afd0dbd6166879237df822
- SHA1
  
  3a4fb913f82082633f6130f12c28fa10b53db91e
- SHA256
  
  5f55d8c4830b28a08183d87428064f6a641f7c95ffe373cafe1ecb8b36043d99
- SHA512
  
  2c853287bddd0156f486ec8e7f36ee8d4a1f2e47b43c9a4f126e980546ce4359de7f7c1bfd2db1133cdfa5b99e64587b9e1f85898fc1eb95ac3d7b4161a181dc
Score

10^/10

xpertrat collection evasion persistence rat trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- XpertRAT
  XpertRAT is a remote access trojan with various capabilities.
  rat xpertrat
- Adds policy Run key to start application
  persistence
- Windows security modification
  evasion trojan
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Program crash
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xpertratcollectionevasionpersistencerattrojan

behavioral2

xpertratevasionpersistencerattrojan