Extracted

• • Target

    6962527d9ac313319bd2b87cd12ab32c_JaffaCakes118

  • Size

    1.1MB

  • MD5

    6962527d9ac313319bd2b87cd12ab32c

  • SHA1

    cd5c57102e56d6af901919edf41dd85d9f012351

  • SHA256

    e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a

  • SHA512

    048f07a350e08d49e70b3a1a1d017c515f700ad0de2415130efe71c455b81cd656ab820104eff6bf39444d9cae1c2220066715ed8efec0e898602e9ea5ab3532

  • SSDEEP

    12288:Z2PCI9ykuSRPFqiVx/kTarr86nHKzCKE7tSlR/h0QRVDNwm:ZM9Pu2Fc6r8y3KcQ7/h0Uu

  Score

  10^/10

  xpertratkaffyvirusevasionpersistencerattrojan

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core payload

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2