xpertrat | 3617f700240f1deb93428b6b6adb492bef67bae7683427c9263f98d56694ca5c | Triage

Sharing

General

Target

3617f700240f1deb93428b6b6adb492bef67bae7683427c9263f98d56694ca5c
Size

1.2MB
Sample

220725-e2589aefa6
MD5

f8a802ca74aa6b14b8134b7f8695d65f
SHA1

6d156982a55de12d58457d9ea2c604b11f98f479
SHA256

3617f700240f1deb93428b6b6adb492bef67bae7683427c9263f98d56694ca5c
SHA512

0992ebb0a8ad13e1fc0762dc529d7887a9ec0b504e9c0de2b74234ca081bff1b27f43c81fb3e72956a46d61e07500bcf6e776eea0405a789202cc2633556a1d4

Score

10^/10

xpertrat evasion persistence rat trojan

Malware Config

Targets

- Target
  
  3617f700240f1deb93428b6b6adb492bef67bae7683427c9263f98d56694ca5c
- Size
  
  1.2MB
- MD5
  
  f8a802ca74aa6b14b8134b7f8695d65f
- SHA1
  
  6d156982a55de12d58457d9ea2c604b11f98f479
- SHA256
  
  3617f700240f1deb93428b6b6adb492bef67bae7683427c9263f98d56694ca5c
- SHA512
  
  0992ebb0a8ad13e1fc0762dc529d7887a9ec0b504e9c0de2b74234ca081bff1b27f43c81fb3e72956a46d61e07500bcf6e776eea0405a789202cc2633556a1d4
Score

10^/10

xpertrat evasion persistence rat trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- XpertRAT
  XpertRAT is a remote access trojan with various capabilities.
  rat xpertrat
- Adds policy Run key to start application
  persistence
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2

xpertratevasionpersistencerattrojan