Extracted

• • Target

    cf5eaf5016b20b65c805de7e5e074a85_JaffaCakes118

  • Size

    728KB

  • MD5

    cf5eaf5016b20b65c805de7e5e074a85

  • SHA1

    1b89c182e8421d1b28feec2308cfbb1ce455dd79

  • SHA256

    54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422

  • SHA512

    b3a6cb9d8d686ea1f4ce312ef6f0269cee5fa3df1eb773f672ff2aa2da6c6a0e1b40acedaa8e3fd1fb723304f0e61455886872fb0622368b64cc5a4e98d03158

  • SSDEEP

    12288:UY3h8l+++++++++0x0XSJgr8TnVEv+vl+D1PXd:xh8l+++++++++0+XNr8ZEvKlGP

  Score

  10^/10

  xpertratpunchesdiscoveryevasionpersistencerattrojan

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core payload

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2