Overview

overview

10

Static

static

10

1532-80-0x...ry.exe

windows7-x64

1

1532-80-0x...ry.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1532-80-0x0000000000400000-0x0000000000443000-memory.dmp

  • Size

    268KB

  • MD5

    f4490fee4229e1df32bb96f965c06fc6

  • SHA1

    69f8b30a5b3a59a80d8bd693b99a85558db24ff3

  • SHA256

    b38a119dca8f075471c1fd509ea86824b6b85405988317b76599f4fbaca94e2e

  • SHA512

    da585f6e1692d8f44096b8236d74970037b40d7fe7a0b5a3afcc45a3226557929c8b62ea384be3d6ad214dc46720354fd420b9880f9326774246a432a2ba5de6

  • SSDEEP

    3072:A4evOVoI9v0QhO3UZuGAT1PFluuXD5FNof9ziCl7xJMJa/Z6CNvS+xke1:rrh0hFtFe9mCBsJaci6+7

Score
10/10
salesxpertrat

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

sales

C2

103.212.81.159:5134

Mutex

P0U4N118-N5L3-W331-B1K0-Y2V3O6B8B2Q6

Signatures

  • XpertRAT Core payload 1 IoCs
  • Xpertrat family
    xpertrat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1532-80-0x0000000000400000-0x0000000000443000-memory.dmp
    .exe windows x86

    237ca8bf125d5d9e5ef0f3b7aae627ff


    Headers

    Imports

    Sections