Extracted

• • Target

    2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118

  • Size

    325KB

  • MD5

    2578debd234465c8aa7bcdf53bc3858a

  • SHA1

    aaec53a7560318b698cec4f1388f26b1c12f9c40

  • SHA256

    0f4e7faf833c30ed300efa46b4b1d083523d48ec2864f110d2a2d5b47eb67a72

  • SHA512

    849947365c47ab82f54d7e7b6a5105e28bf684cff0ad3f313541722dcc2b0ae9bbdeb794b771a32a07fd6b1f071f2b99e7c8464167aff036a622fc969ce4fcdf

  • SSDEEP

    6144:KiMD5bWl4fAAH3gyLBVpRQ7Wm5qRnu1goA:hl4bHQydlQamL/A

  Score

  10^/10

  xpertratgroupevasionrattrojan

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  behavioral1behavioral2