Extracted

• • Target

    2235ed553b50f5923d2594bf1d7a4fbc175ddf3e498b4aab995dfb289b775f17.exe

  • Size

    744KB

  • MD5

    6c6a9c70763f799ac9d4ca55a292c3f4

  • SHA1

    af4ebcfdd1624a077cd0f1a1c77f04076a974714

  • SHA256

    2235ed553b50f5923d2594bf1d7a4fbc175ddf3e498b4aab995dfb289b775f17

  • SHA512

    d21fc33c06169f58735333d95455636dfe0054021c884fa01df846d4bf0fd1085982475f47b0aba26ba782d66ce10317eadc34c6d3a28f8bd458c2ffda6231fc

  • SSDEEP

    12288:VzukkVr/MhE6JOA6lfHcb+L1LkUrzx0E+qKlR5yaMxTEaD:NhE6JOAiPVgUrCvR5yaMxTEaD

  Score

  10^/10

  xpertratgroupdefense_evasiondiscoverypersistencerattrojan

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core payload

  • Xpertrat family

    xpertrat

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2