Extracted

• • Target
    JaffaCakes118_3ce6d4efe12e06695e1c5e769c5ce8d1
  • Size 728KB
  • SHA256 4dd234b8d91388ab5f3992d4615e8efec5bb822e8a832856986af0281f48ac57
  • MD5 3ce6d4efe12e06695e1c5e769c5ce8d1
  • SHA1 b8647258402e7387878f9a8585edc789e60540c3
  • SHA512 dc49c64de60c09bafe2a2d4d2d4d260cf991caefa1a417f0be5240740469a2428adaef2cf690629bf40b27d4097fffa45af2ccb0edf96e365040684da70c6ab3
  • SSDEEP 12288:8jzacYKOc0vnrv32MDwrACsdK7KxUsQbHfrbvk:GacYKR0vnrv3rwrACgK77bHTr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  nikitadefense_evasiondiscoveryexecutionxpertratpersistencerattrojan

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat

  • XpertRAT Core payload

  • Xpertrat family

    xpertrat

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Program crash

  • Suspicious use of SetThreadContext

  behavioral1behavioral2