Overview

overview

10

Static

static

gunzipped.exe

windows7_x64

10

gunzipped.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    gunzipped.exe

  • Size

    619KB

  • Sample

    220513-km65wsghel

  • MD5

    5a31075c7e2eede32b52b7e32d16f560

  • SHA1

    1b0325131df5e081f802f907246da4f2331d60c0

  • SHA256

    d6d4f87e9126bf6792e3774f73f9c15e308328bca3f8fcef5f5d943a0904e137

  • SHA512

    d785092dd4cc6ef921c3f5f8146412ae1e4fd0891ed1493c72801f31adfc3b80aac258021d6c7fe97f03e52180f92349a00a3781581801748fad7339fc13bb1d

Score
10/10
xpertratcollectionevasionpersistencerattrojan

Malware Config

Targets

    • Target

      gunzipped.exe

    • Size

      619KB

    • MD5

      5a31075c7e2eede32b52b7e32d16f560

    • SHA1

      1b0325131df5e081f802f907246da4f2331d60c0

    • SHA256

      d6d4f87e9126bf6792e3774f73f9c15e308328bca3f8fcef5f5d943a0904e137

    • SHA512

      d785092dd4cc6ef921c3f5f8146412ae1e4fd0891ed1493c72801f31adfc3b80aac258021d6c7fe97f03e52180f92349a00a3781581801748fad7339fc13bb1d

    Score
    10/10
    xpertratcollectionevasionpersistencerattrojan

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • XpertRAT

      XpertRAT is a remote access trojan with various capabilities.

      ratxpertrat

    • Adds policy Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Windows security modification

      evasiontrojan

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Program crash

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

3
T1089

Modify Registry

6
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks