Extracted

• • Target

    f280eacb46b0ee5c9768d38c8a8ff717_JaffaCakes118

  • Size

    1.1MB

  • MD5

    f280eacb46b0ee5c9768d38c8a8ff717

  • SHA1

    347c922cd531bd00c6839738222ea811a8700754

  • SHA256

    623836d21130037a5ca69a4517e27020b2633de86a0f8b8d614c2268750881d1

  • SHA512

    13a90ecf9241f9a4e1fc078e50e6282cb6f15d7cb0c3f152d1013c860b6e4c1da5bff4b54a7450fc7db5644f265d34aca29a047f8eff714259f654b8e8f9c7c3

  • SSDEEP

    24576:wAHnh+eWsN3skA4RV1Hom2KXMmHa7/wQ5tyFYHkMNxOaw5:nh+ZkldoPK8Ya7/7tyFPF

  Score

  10^/10

  discoverypersistencexpertratclient xevasionrattrojan

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core payload

  • Adds policy Run key to start application

    persistence

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2