xpertrat | 862bf290697cfbd5cb41966b550e8b163aac94d6e07461c6e4353ea6fad62e83 | Triage

Sharing

General

Target

eefa3dd3a36a5decba3c42072ef0798e_JaffaCakes118
Size

911KB
Sample

240412-djsd1agd6s
MD5

eefa3dd3a36a5decba3c42072ef0798e
SHA1

a51f4f499fc618b9dc36e079258ed3c087e2bae5
SHA256

862bf290697cfbd5cb41966b550e8b163aac94d6e07461c6e4353ea6fad62e83
SHA512

6e28230749c2938279e32d4c2631ea6193f28c2a5d5cd38f4176dc8e5e70a986db866e770ff32e4eaad3233b8e336f66877e1e2c70c9ef5ec2f3912f9df7d6a2
SSDEEP

12288:bJmWMzH+hB/pzxJi3X3+b6umJBDARbeqTJgRGL1xPJH1gOk2jNdgx8qNUn3PHMO:TLpXk+b6umJBDAJeqtgR8XN1g4EO

Score

10^/10

xpertrat evasion persistence rat trojan

Malware Config

Targets

- Target
  
  eefa3dd3a36a5decba3c42072ef0798e_JaffaCakes118
- Size
  
  911KB
- MD5
  
  eefa3dd3a36a5decba3c42072ef0798e
- SHA1
  
  a51f4f499fc618b9dc36e079258ed3c087e2bae5
- SHA256
  
  862bf290697cfbd5cb41966b550e8b163aac94d6e07461c6e4353ea6fad62e83
- SHA512
  
  6e28230749c2938279e32d4c2631ea6193f28c2a5d5cd38f4176dc8e5e70a986db866e770ff32e4eaad3233b8e336f66877e1e2c70c9ef5ec2f3912f9df7d6a2
- SSDEEP
  
  12288:bJmWMzH+hB/pzxJi3X3+b6umJBDARbeqTJgRGL1xPJH1gOk2jNdgx8qNUn3PHMO:TLpXk+b6umJBDAJeqtgR8XN1g4EO
Score

10^/10

xpertrat evasion persistence rat trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- XpertRAT
  XpertRAT is a remote access trojan with various capabilities.
  rat xpertrat
- Adds policy Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xpertratevasionpersistencerattrojan

behavioral2

xpertratevasionpersistencerattrojan