Overview

overview

10

Static

static

SecuriteIn...61.exe

windows7_x64

10

SecuriteIn...61.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Variant.Ser.Lazy.948.25861.26687
  • Size 512KB
  • Sample220512-3tenbseabq
  • SHA256 0a35b0e0112fc3ffb7fb29e2f7afa092ae3b5932ff8e79c7a9b5365ad5e08013
  • MD5 SHA1 SHA512
Score
10/10
xpertratcollectionevasionpersistencerattrojan

Malware Config

Targets

    • Target
      SecuriteInfo.com.Variant.Ser.Lazy.948.25861.26687
    • Size 512KB
    • SHA256 0a35b0e0112fc3ffb7fb29e2f7afa092ae3b5932ff8e79c7a9b5365ad5e08013
    • MD5 SHA1 SHA512
    Score
    10/10
    xpertratcollectionevasionpersistencerattrojan

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • XpertRAT

      XpertRAT is a remote access trojan with various capabilities.

      ratxpertrat

    • Adds policy Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Program crash

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks