Overview
overview
10Static
static
3XpertRAT v...lf.rar
windows10-2004-x64
1XpertRAT v...lf.rar
windows11-21h2-x64
1All Hackin...s.html
windows10-2004-x64
3All Hackin...s.html
windows11-21h2-x64
4XpertRAT v...lf.exe
windows10-2004-x64
1XpertRAT v...lf.exe
windows11-21h2-x64
1setup.bat
windows10-2004-x64
10setup.bat
windows11-21h2-x64
10Analysis
- max time kernel
898s - max time network
397s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
14/05/2026, 01:17
Static task
static1
Behavioral task
behavioral1
Sample
XpertRAT v3.0.10 by blackwolf.rar
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
XpertRAT v3.0.10 by blackwolf.rar
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
All Hacking Tools.html
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
All Hacking Tools.html
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
XpertRAT v3.0.10 by Blackwolf.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
XpertRAT v3.0.10 by Blackwolf.exe
Resource
win11-20260513-en
Behavioral task
behavioral7
Sample
setup.bat
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
setup.bat
Resource
win11-20260513-en
General
- Target XpertRAT v3.0.10 by blackwolf.rar
- Size 11.9MB
- Sample260514-bnk5dads2j
- SHA256 d7ff7434af1e2ba9571830e6adef6ca5403cd6c95aa3e5f50924b2f9c40fd40e
- MD5 2273f554b9fdc394fa349ad6563da414
- SHA1 4e6d223f55ec8cd8e8d5e360eef9de6bface3f9d
- SHA512 f972638f0690d65a449d5d59c06f6bf6b2e13618a9dcf2c88b932cfd5c26fcdf4bbac1e692ba51ceac6d27f398bec9c616801f0d11b51f98dc94141bc2f3934a
- SSDEEP 196608:FEJ3PLxbaxaHfuc4e7wzvpNnfXkszfeyvAjuCCzpJBCcGXHrA:6JfpxWZZd5f0sbCg0k
- TLSH T172C633C09374D757CD3C06FBF497BE6CD96648990ACB6C3B6A2A4336C6835510E0AB27
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3736 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 3736 7zFM.exe Token: 35 3736 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3736 7zFM.exe