xpertrat | 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8 | Triage

Sharing

General

Target

986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8
Size

1014KB
Sample

220415-tbgwasbed7
MD5

66b911f4bd33b3c563164c85b59f2e18
SHA1

0ce658b5bdf3ccfa3140df8b9d2beb1562331ed1
SHA256

986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8
SHA512

050f19ec427b97850692e5ddd7f4076724e9e74c8b157e41257d00e867b1cebbf6faf5db7a2b7998a9c0bf89d13e891912d92c961c20024368debbbe07a0e0bc

Score

10^/10

xpertrat evasion persistence rat trojan

Malware Config

Targets

- Target
  
  986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8
- Size
  
  1014KB
- MD5
  
  66b911f4bd33b3c563164c85b59f2e18
- SHA1
  
  0ce658b5bdf3ccfa3140df8b9d2beb1562331ed1
- SHA256
  
  986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8
- SHA512
  
  050f19ec427b97850692e5ddd7f4076724e9e74c8b157e41257d00e867b1cebbf6faf5db7a2b7998a9c0bf89d13e891912d92c961c20024368debbbe07a0e0bc
Score

10^/10

xpertrat evasion persistence rat trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- XpertRAT
  XpertRAT is a remote access trojan with various capabilities.
  rat xpertrat
- Adds policy Run key to start application
  persistence
- Deletes itself
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

xpertratevasionpersistencerattrojan

behavioral2

xpertratevasionpersistencerattrojan