Overview

overview

10

Static

static

10

3036-81-0x...ry.exe

windows7-x64

1

3036-81-0x...ry.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3036-81-0x0000000000400000-0x0000000000443000-memory.dmp

  • Size

    268KB

  • MD5

    33c43da1a01a9369adec4c8f6e511378

  • SHA1

    4d5bddae81786a8d4f1aaef586b6843e68cdec00

  • SHA256

    3007fb3b4e4f881f5abdf47f73683b7cedfb3494c70022c8c65708d2846a94ec

  • SHA512

    09ab1fc3730a2d5f7808b9e0b0eb1893962923bc662b0cb9e2e5e8e3bfb2b5c30ada22112f7006b62dbe51684001fc5463dddebbdc302483698b492f510ae43c

  • SSDEEP

    3072:g4evOVoI9v0QhO3UZuGAT1PFluuXD5FNof9ziCl7xJMJa/Z6CNvS+xk0P:Lrh0hFtFe9mCBsJaci6+f

Score
10/10
flexxpertrat

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

FLEX

C2

sandshoe.myfirewall.org:5344

Mutex

U1B5S2E0-S6R4-Y4O1-P7F0-W443P1Y6S3M2

Signatures

  • XpertRAT Core payload 1 IoCs
  • Xpertrat family
    xpertrat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 3036-81-0x0000000000400000-0x0000000000443000-memory.dmp
    .exe windows:4 windows x86

    237ca8bf125d5d9e5ef0f3b7aae627ff


    Headers

    Imports

    Sections