xpertrat | ace7357cb47c8f0c23ee7e1f6fe9ca94c7c1d25bd39ad7965174d3e7dedec70f | Triage

Sharing

General

Target

ef2d0d45bafd7c1f5cf4564c1307ea7d
Size

433KB
Sample

231220-vfwqpabgc6
MD5

ef2d0d45bafd7c1f5cf4564c1307ea7d
SHA1

0b7e8ad2f1bb148a6139433c724ccb9c63cff3e2
SHA256

ace7357cb47c8f0c23ee7e1f6fe9ca94c7c1d25bd39ad7965174d3e7dedec70f
SHA512

6fed8cb6985cd66a11356f377b19cd1b00f47bc35262b741e3d1b7a32048dde24a82feb0bbbf361ce1ea91cab6b0aa877e417d76377b7bbb3ae11247271bcbfa
SSDEEP

12288:/pz3X0sr9b0i55JKbDNSSkauKkEMfhhYYNZuCCCyBFu9:/RSnuKkEMfnN8CC38

Score

10^/10

xpertrat test evasion persistence rat trojan

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

Test

C2

kapasky-antivirus.firewall-gateway.net:4000

Mutex

L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0

Targets

- Target
  
  ef2d0d45bafd7c1f5cf4564c1307ea7d
- Size
  
  433KB
- MD5
  
  ef2d0d45bafd7c1f5cf4564c1307ea7d
- SHA1
  
  0b7e8ad2f1bb148a6139433c724ccb9c63cff3e2
- SHA256
  
  ace7357cb47c8f0c23ee7e1f6fe9ca94c7c1d25bd39ad7965174d3e7dedec70f
- SHA512
  
  6fed8cb6985cd66a11356f377b19cd1b00f47bc35262b741e3d1b7a32048dde24a82feb0bbbf361ce1ea91cab6b0aa877e417d76377b7bbb3ae11247271bcbfa
- SSDEEP
  
  12288:/pz3X0sr9b0i55JKbDNSSkauKkEMfhhYYNZuCCCyBFu9:/RSnuKkEMfnN8CC38
Score

10^/10

xpertrat test evasion persistence rat trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- XpertRAT
  XpertRAT is a remote access trojan with various capabilities.
  rat xpertrat
- XpertRAT Core payload
- Adds policy Run key to start application
  persistence
- Deletes itself
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

xpertrattestevasionpersistencerattrojan

behavioral2

xpertrattestevasionpersistencerattrojan