General
- Target 160e03b0116adf6688549729b61518eb_JaffaCakes118
- Size 1.3MB
- Sample241005-efcptatfpq
- SHA256 b57ce6a053e28a6e8605e6cf462cb865d4286e20b043114098307d74fefe3302
Score
10/10
Malware Config
Extracted
Family
-
xpertrat
Version
-
3.0.10
Botnet
-
Test
C2
-
185.125.205.93:9911
Mutex
-
P0V4N118-N5M3-W331-C1L0-Y2V3P6C8B2Q6
Targets
-
- Target 160e03b0116adf6688549729b61518eb_JaffaCakes118
- Size 1.3MB
- SHA256 b57ce6a053e28a6e8605e6cf462cb865d4286e20b043114098307d74fefe3302
Score10/10-
UAC bypass
-
Windows security bypass
-
XpertRAT
XpertRAT is a remote access trojan with various capabilities.
-
XpertRAT Core payload
-
Windows security modification
-
Checks whether UAC is enabled
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
4