Extracted

• • Target

    ef2d0d45bafd7c1f5cf4564c1307ea7d

  • Size

    433KB

  • MD5

    ef2d0d45bafd7c1f5cf4564c1307ea7d

  • SHA1

    0b7e8ad2f1bb148a6139433c724ccb9c63cff3e2

  • SHA256

    ace7357cb47c8f0c23ee7e1f6fe9ca94c7c1d25bd39ad7965174d3e7dedec70f

  • SHA512

    6fed8cb6985cd66a11356f377b19cd1b00f47bc35262b741e3d1b7a32048dde24a82feb0bbbf361ce1ea91cab6b0aa877e417d76377b7bbb3ae11247271bcbfa

  • SSDEEP

    12288:/pz3X0sr9b0i55JKbDNSSkauKkEMfhhYYNZuCCCyBFu9:/RSnuKkEMfnN8CC38

  Score

  10^/10

  xpertrattestevasionpersistencerattrojan

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core payload

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2