Extracted

• • Target
    2235ed553b50f5923d2594bf1d7a4fbc175ddf3e498b4aab995dfb289b775f17.exe
  • Size 744KB
  • SHA256 2235ed553b50f5923d2594bf1d7a4fbc175ddf3e498b4aab995dfb289b775f17
  • MD5 6c6a9c70763f799ac9d4ca55a292c3f4
  • SHA1 af4ebcfdd1624a077cd0f1a1c77f04076a974714
  • SHA512 d21fc33c06169f58735333d95455636dfe0054021c884fa01df846d4bf0fd1085982475f47b0aba26ba782d66ce10317eadc34c6d3a28f8bd458c2ffda6231fc
  • SSDEEP 12288:VzukkVr/MhE6JOA6lfHcb+L1LkUrzx0E+qKlR5yaMxTEaD:NhE6JOAiPVgUrCvR5yaMxTEaD
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xpertratgroupdefense_evasiondiscoverypersistencerattrojan

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core payload

  • Xpertrat family

    xpertrat

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2