Extracted

• • Target

    73fad7f43d84bcda12adbfa6cd8e9ea6_JaffaCakes118

  • Size

    304KB

  • MD5

    73fad7f43d84bcda12adbfa6cd8e9ea6

  • SHA1

    1df1082319f6a9f37ed33c412881334be226f1b5

  • SHA256

    9a2c9d0f5f889043eac309a2111fdaae1f52b8b939e732ecb4ab7fa01753603d

  • SHA512

    19dff05edd6eae4660ce2bd407b165935282cbeefe01d81c070b7cfdf08125a70b448e38fc6057cdf9ba8a75d7ad2fca69cc26b50a5a5b62467feedfded8582b

  • SSDEEP

    3072:LGRb3FWp+W33MqSytZdiiBY3B6Qk5TZwBVr3W/s3O2Lb4L0FM8Q/:Labm3MUnpikT66GOCb44FM8

  Score

  10^/10

  xpertratgroupdefense_evasiondiscoveryevasionrattrojan

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops desktop.ini file(s)

  • Program crash

  • Suspicious use of SetThreadContext

  behavioral1behavioral2