Extracted

• • Target

    920a84f8fce7b1b7bed3e1c7dfed6ace_JaffaCakes118

  • Size

    931KB

  • MD5

    920a84f8fce7b1b7bed3e1c7dfed6ace

  • SHA1

    62ec70792894b003aa5ad208b576a2e182f0d3f0

  • SHA256

    a36735377d731d16330587a190a99acbd5a1d9556e066d771268f8b4b6cd3821

  • SHA512

    f2da84c7e5f0154d45b7db2077b3bc514d6bf5d9de41888ba0469ceeb545c01455730d45144e07daabeb789ee85ca7978a55ac18cd57cfc2771204b58bb5aed2

  • SSDEEP

    12288:LR94nvMreRXa/yla6Uqm+o/kDrzlqGZQ+3ocujQNIqWiLpYruy5g1aj9/RdLIT5C:LR9eRXa/Sa6Uq0/kDrzRb26nnjqKoeK

  Score

  10^/10

  xpertratxboxdiscoveryevasionpersistencerattrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core payload

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2