Overview

overview

10

Static

static

10

1080-49-0x...ry.exe

windows7-x64

1

1080-49-0x...ry.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1080-49-0x0000000000400000-0x0000000000443000-memory.dmp

  • Size

    268KB

  • MD5

    6aae816751a2d1abc7fc8e86cab77867

  • SHA1

    d0724d7f420c39f4769cc403343eca85b1237682

  • SHA256

    b33d96b4d5092b5a8c6ea56d9a7e4bf5997696dde92d970b8d60cfe3f882d15e

  • SHA512

    4bd4678a13e8ddd39b71aeaf106e20669de148316efd2185af3aafe438af2a920bb54f59183e44b0f05260f6c91f91b0ea8d93bde5a9053650a2c6eea3f64e90

  • SSDEEP

    3072:Y4evOVoI9v0QhO3UZuGAT1PFluuXD5FNof9ziCl7xJMJa/Z6CNvS+xkVg:zrh0hFtFe9mCBsJaci6+R

Score
10/10
strigioxpertrat

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

STRIGIO

C2

sandshoe.myfirewall.org:5344

Mutex

I8N3F0X7-G4E2-P2S0-T0D7-R1N2H5T660I4

Signatures

  • XpertRAT Core payload 1 IoCs
  • Xpertrat family
    xpertrat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1080-49-0x0000000000400000-0x0000000000443000-memory.dmp
    .exe windows:4 windows x86

    237ca8bf125d5d9e5ef0f3b7aae627ff


    Headers

    Imports

    Sections