Extracted

• • Target

    c24566c0745944cbc188bca73f43e78f9824a22f05089665e6e09f01294f5c46

  • Size

    510KB

  • MD5

    2cb0027810b1ef32a2756804027c3436

  • SHA1

    56f8636adbf50d1265319f08d6872daff2b75815

  • SHA256

    c24566c0745944cbc188bca73f43e78f9824a22f05089665e6e09f01294f5c46

  • SHA512

    6d805f59561eb3dd70f8c74d16439c767b58f67dffe0104decf662616c302de04e8795e67ba287b1837062a6ef6379961c915c0f29e70a8bb8bbdc85dd26a09d

  • SSDEEP

    12288:B35yabQ2GGAR0rdDfrb8RQMiPMO6Wq0s13O4BfhjAA3m8h:p5yR/GARuhfruQR7vsFOkjAAjh

  Score

  10^/10

  xpertratstrigioevasionpersistencerattrojan

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core payload

  • Adds policy Run key to start application

    persistence

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1