MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ca3cfc63c029b0d6a0d312cac86c5dc77e9efe86dd711a08e1f25d0ec62c366. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XpertRAT


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ca3cfc63c029b0d6a0d312cac86c5dc77e9efe86dd711a08e1f25d0ec62c366
SHA3-384 hash: dbf0e9c8d6f71a5d023677b02a64d97d40af9af0cfe92ffcca3a43b0eba8a5b9cd4f09902400d68a6758f54c0f789ad2
SHA1 hash: 43d820ee908bff37ed63dc8a13d8782637bd3203
MD5 hash: a5523425c4a1ec48a104970e15e55978
humanhash: california-floor-montana-freddie
File name:a5523425c4a1ec48a104970e15e55978.exe
Download: download sample
Signature XpertRAT
Create hunting rule
File size:16'024 bytes
First seen:2021-04-23 17:39:09 UTC
Last seen:2021-04-23 18:50:06 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 384:ikbkUs00hFzm+xPyKEBXBCI4l9XSiJSiYSihhR:icP0hFa+APMpiiwiNihhR
Threatray 4'807 similar samples on MalwareBazaar
TLSH F0724B6587D41D0DFC7F5330B1F189242F34ABD1A6228BAF209892C84F523C195EEA7A
Reporter abuse_ch
Tags:exe RAT XpertRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
153
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/143920/
Detection(s):
SecuriteInfo.com.W32.MSIL_Kryptik.DNB.genEldorado.13653.4984.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending an HTTP GET request
Sending a UDP request
Creating a file
Running batch commands
Creating a process with a hidden window
Launching a process
Adding an access-denied ACE
Creating a window
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Creating a file in the %temp% directory
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Deleting a recently created file
Unauthorized injection to a recently created process
Blocking the User Account Control
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Enabling autorun
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f3f849eb-c2e7-4cf8-af36-cdea738f78b7
Result
Threat name:
MailPassView XpertRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/695740
Signature
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to hide a thread from the debugger
Creates an undocumented autostart registry key
Creates autostart registry keys with suspicious names
Detected unpacking (creates a PE file in dynamic memory)
Disables user account control notifications
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to steal Mail credentials (via file registry)
Uses dynamic DNS services
Yara detected Generic Dropper
Yara detected MailPassView
Yara detected WebBrowserPassView password recovery tool
Yara detected XpertRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 396799 Sample: XSvtZnAK88.exe Startdate: 23/04/2021 Architecture: WINDOWS Score: 100 75 Malicious sample detected (through community Yara rule) 2->75 77 Multi AV Scanner detection for submitted file 2->77 79 Yara detected MailPassView 2->79 81 6 other signatures 2->81 9 XSvtZnAK88.exe 15 4 2->9         started        13 L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0.exe 3 2->13         started        15 L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0.exe 2->15         started        17 L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0.exe 2->17         started        process3 dnsIp4 73 xwjhdjylqeypyltby.ml 104.21.88.107, 49714, 80 CLOUDFLARENETUS United States 9->73 91 Detected unpacking (creates a PE file in dynamic memory) 9->91 93 Hides threads from debuggers 9->93 95 Injects a PE file into a foreign processes 9->95 97 Contains functionality to hide a thread from the debugger 9->97 19 XSvtZnAK88.exe 1 1 9->19         started        22 WerFault.exe 23 9 9->22         started        25 cmd.exe 1 9->25         started        99 Multi AV Scanner detection for dropped file 13->99 101 Machine Learning detection for dropped file 13->101 27 cmd.exe 13->27         started        29 L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0.exe 13->29         started        31 WerFault.exe 13->31         started        33 cmd.exe 15->33         started        signatures5 process6 file7 83 Changes security center settings (notifications, updates, antivirus, firewall) 19->83 85 Disables user account control notifications 19->85 35 iexplore.exe 3 8 19->35         started        67 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 22->67 dropped 40 conhost.exe 25->40         started        42 timeout.exe 1 25->42         started        44 conhost.exe 27->44         started        46 timeout.exe 27->46         started        48 conhost.exe 33->48         started        50 timeout.exe 33->50         started        signatures8 process9 dnsIp10 69 ghytrty.duckdns.org 45.144.225.94, 4145, 49725, 49726 DEDIPATH-LLCUS Netherlands 35->69 63 L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0.exe, PE32 35->63 dropped 65 C:\...\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0, data 35->65 dropped 87 Creates an undocumented autostart registry key 35->87 89 Creates autostart registry keys with suspicious names 35->89 52 iexplore.exe 35->52         started        54 iexplore.exe 35->54         started        57 iexplore.exe 1 35->57         started        59 3 other processes 35->59 file11 signatures12 process13 dnsIp14 61 WerFault.exe 52->61         started        71 192.168.2.1 unknown unknown 54->71 process15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1ca3cfc63c029b0d6a0d312cac86c5dc77e9efe86dd711a08e1f25d0ec62c366/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-23 16:21:05 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dsr47rr4aknq22qngewkzbwf3r36t37inxlrdieod4s5b3dcynta._file
Verdict:
unknown
Similar samples:
128fa77a11cedbe782819f0d2e2666a04e4f8d2966a72f215c77b8933c914a47
XpertRAT
49b1f7e34f74b3ea4b97852292dfd6e856a58f74a181f5a3aadd6356503ae617
XpertRAT
53174a644680154786d09b66cc8c4a1aa83c625bd10137600bf191573fa5c602
XpertRAT
737b239acfab89839b6bba6e0282a8949b2c1212803e94f76d7d9355b3e377ec
XpertRAT
7c38d073b77ff7afc8f65aac812316d0fa9356115f1f3e78aca9fd496d177cad
XpertRAT
8c63a7665a27d47e20bd74c4aaba5cf4a76d981bfd52820f935efd097dcfda3d
XpertRAT
a6c456dcee9a9c53aeb0360bdb52a682137745ad9ec607fce1199e24cd348ee5
XpertRAT
aeb3ee199361c07c05d92f5b40c010bfebda15a3429364ac6ab5f4e7b203afa9
XpertRAT
c65e2de75fb34171072925ff6d7c2a9fa79e5d311c4296dacf7a12d524b4167d
XpertRAT
fae8f28a64d1321bc7c90bdadca9edb951cc115bad51fde5347a85d8a6708d3e
XpertRAT
+ 4'797 additional samples on MalwareBazaar
Result
Malware family:
xpertrat
Create hunting rule
Score:
  10/10
Tags:
family:xpertrat evasion persistence rat trojan upx
Link:
https://tria.ge/reports/210423-778svc3xt2/
Behaviour
Delays execution with timeout.exe
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Windows security modification
Adds policy Run key to start application
UPX packed file
NirSoft MailPassView
NirSoft WebBrowserPassView
Nirsoft
UAC bypass
Windows security bypass
XpertRAT
XpertRAT Core Payload
Unpacked files
SH256 hash:
1ca3cfc63c029b0d6a0d312cac86c5dc77e9efe86dd711a08e1f25d0ec62c366
MD5 hash:
a5523425c4a1ec48a104970e15e55978
SHA1 hash:
43d820ee908bff37ed63dc8a13d8782637bd3203
Link:
https://www.unpac.me/results/111ce702-80ea-439e-9464-44c01f134e13/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

XpertRAT

Executable exe 1ca3cfc63c029b0d6a0d312cac86c5dc77e9efe86dd711a08e1f25d0ec62c366

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1157955/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/143920/

Comments