Extracted

• • Target

    Új megrendelés - 00905173088 CPTL árajánlat - egyenként 100.exe

  • Size

    110KB

  • MD5

    e18a8e37b5d2cfaec89222fd74c88081

  • SHA1

    19a794cb433dc4445e33becc7c2ce7d211baefa6

  • SHA256

    31ec85607b59877f42e791a2ac23d8c8c95edc8bad7fc0939a90a3807f445c6d

  • SHA512

    287358b925ff7a6e214ea29612461c94fbc12eb145a8ed3cfc8a7400151a6fe7ebc399d6ae0ad22d31dd8b9e2082668957a30baca807502cf1a78beb33b5c2c8

  • SSDEEP

    1536:Kx+EiewYluxHtThsiP34bbCaFJqIc5fpD7/xL:KrvyRhsiffaKIc5hDF

  Score

  10^/10

  xpertratblazecollectionevasionpersistencerattrojanupx

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core payload

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Adds policy Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2