xpertrat | 05cc3666016454b90c6fd02b60f6f9467ba36e3300449a7fe1f0941048606657 | Triage

Submit
Reports

Overview

overview

Static

static

05cc366601...57.exe

windows7_x64

5

05cc366601...57.exe

windows10-2004_x64

Sharing

General

Target

05cc3666016454b90c6fd02b60f6f9467ba36e3300449a7fe1f0941048606657
Size

2.1MB
Sample

220420-cskj3sddgk
MD5

07c3708de3c443f315ad847b3f67b260
SHA1

7a4cb398dfd4735dd853358a853375cea6ef1db6
SHA256

05cc3666016454b90c6fd02b60f6f9467ba36e3300449a7fe1f0941048606657
SHA512

ee3839901639cbc4bb5a7bc8cfc379a03a0547d9d1f455e08fba3d24cfd75c3ca33ea1edc9d74972afc0288629c77d4b47384c33d9a356ad7c1d29cb13d7f5b9

Score

10^/10

xpertrat evasion persistence rat trojan

Static task

static1

Behavioral task

behavioral1

Sample

05cc3666016454b90c6fd02b60f6f9467ba36e3300449a7fe1f0941048606657.exe

Resource

win7-20220414-en

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

05cc3666016454b90c6fd02b60f6f9467ba36e3300449a7fe1f0941048606657.exe

Resource

win10v2004-20220414-en

xpertrat evasion persistence rat trojan

windows10-2004_x64

0 signatures

0 seconds

Malware Config

Targets

- Target
  
  05cc3666016454b90c6fd02b60f6f9467ba36e3300449a7fe1f0941048606657
- Size
  
  2.1MB
- MD5
  
  07c3708de3c443f315ad847b3f67b260
- SHA1
  
  7a4cb398dfd4735dd853358a853375cea6ef1db6
- SHA256
  
  05cc3666016454b90c6fd02b60f6f9467ba36e3300449a7fe1f0941048606657
- SHA512
  
  ee3839901639cbc4bb5a7bc8cfc379a03a0547d9d1f455e08fba3d24cfd75c3ca33ea1edc9d74972afc0288629c77d4b47384c33d9a356ad7c1d29cb13d7f5b9
Score

10^/10

xpertrat evasion persistence rat trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- XpertRAT
  XpertRAT is a remote access trojan with various capabilities.
  rat xpertrat
- Adds policy Run key to start application
  persistence
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

xpertratevasionpersistencerattrojan

© 2018-2024

Terms | Privacy