xpertrat | 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4 | Triage

Submit
Reports

Overview

overview

Static

static

683a36a87b...d4.exe

windows7_x64

683a36a87b...d4.exe

windows10-2004_x64

Sharing

General

Target

683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4
Size

638KB
Sample

220511-c871bagfgn
MD5

043bbfccd9e9deebe4559e291dbebda1
SHA1

0e6da4ccaed482767eb94a61679b5f24375f24d3
SHA256

683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4
SHA512

41e4ea16800ddc0078eca1260f6ef07cd33a1c849802437a2c5868a4bf2fc4ee8b4f480f63e30f88d6e63eab733916fe5f6ec8fd2d3ce91a8bd6bfa4c98a4cc5

Score

10^/10

xpertrat evasion persistence rat trojan

Static task

static1

Behavioral task

behavioral1

Sample

683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe

Resource

win7-20220414-en

xpertrat evasion persistence rat trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe

Resource

win10v2004-20220414-en

windows10-2004_x64

0 signatures

0 seconds

Malware Config

Targets

- Target
  
  683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4
- Size
  
  638KB
- MD5
  
  043bbfccd9e9deebe4559e291dbebda1
- SHA1
  
  0e6da4ccaed482767eb94a61679b5f24375f24d3
- SHA256
  
  683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4
- SHA512
  
  41e4ea16800ddc0078eca1260f6ef07cd33a1c849802437a2c5868a4bf2fc4ee8b4f480f63e30f88d6e63eab733916fe5f6ec8fd2d3ce91a8bd6bfa4c98a4cc5
Score

10^/10

xpertrat evasion persistence rat trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- XpertRAT
  XpertRAT is a remote access trojan with various capabilities.
  rat xpertrat
- Adds policy Run key to start application
  persistence
- Deletes itself
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Program crash
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Modify Registry

Disabling Security Tools

Bypass User Account Control

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

xpertratevasionpersistencerattrojan

behavioral2

© 2018-2024

Terms | Privacy