General
- Target jaffacakes118_Trojan.Win32.Delf.tfll.13a486bfa5a8561962e6606f6b54434b
- Size 667KB
- Sample261018-ysm6vsas4w
- SHA256 40339a5c002ded5c5594aff2905fd3cf38a66cd75fd6de05d3845770f1d53cbd
Score
10/10
Malware Config
Extracted
Family
-
xpertrat
Version
-
3.1.9
Botnet
-
Group
C2
-
173.46.85.54:7005
Mutex
-
T4Y0R5C3-R0I8-T7W6-K224-O7V6O4W0K7K6
Targets
-
- Target jaffacakes118_Trojan.Win32.Delf.tfll.13a486bfa5a8561962e6606f6b54434b
- Size 667KB
- SHA256 40339a5c002ded5c5594aff2905fd3cf38a66cd75fd6de05d3845770f1d53cbd
Score10/10-
Family: XpertRAT
XpertRAT is a remote access trojan with various capabilities.
-
UAC bypass
-
Windows security bypass
-
XpertRAT Core payload
-
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE
-
Windows security modification
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5