MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29a4c9380a91012be5a2b3659f9a4c46d0eca15c689a95707f78ccde9cd11f02. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XpertRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 29a4c9380a91012be5a2b3659f9a4c46d0eca15c689a95707f78ccde9cd11f02
SHA3-384 hash: 6f5c61f23c643c8f9f9e68ef998995010cfaeb0025e2d7163657f943e03f2d6a3b4922ebb197128fb267b220a5c1b4b5
SHA1 hash: 439d50691f585b1a3cd674a0852834a97d9fc9cb
MD5 hash: 1f609ed72b74f23379e8d7636b5faa13
humanhash: sodium-north-summer-finch
File name:1f609ed72b74f23379e8d7636b5faa13.exe
Download: download sample
Signature XpertRAT
Create hunting rule
File size:26'112 bytes
First seen:2021-04-25 07:06:47 UTC
Last seen:2021-04-25 07:39:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 384:jwNldKAeOMjd2DSLZK6U6NnETN+iB3vwClFZaQyaOtVjY8GC:2ldKzRd2DS14I06L3GC
Threatray 4'809 similar samples on MalwareBazaar
TLSH AEC2447276366919D19F30318C7132B4D47ADDB93ECB8743B2BD874D1B966AAE10CE02
Reporter abuse_ch
Tags:exe RAT XpertRAT


Avatar
abuse_ch
XpertRAT C2:
spapertyy.duckdns.org

Intelligence

File Origin
# of uploads :
2
# of downloads :
277
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1f609ed72b74f23379e8d7636b5faa13.exe
Verdict:
Malicious activity
Analysis date:
2021-04-25 07:08:00 UTC
Tags:
trojan dtloader loader
Link:
https://app.any.run/tasks/c1a22fc9-f9bc-4664-a7cd-936dd9af5ba3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XpertRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/144062/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.36779733.27699.5980.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending an HTTP GET request
Creating a file
Running batch commands
Creating a process with a hidden window
Launching a process
Adding an access-denied ACE
Sending a UDP request
Creating a window
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Creating a file in the %temp% directory
Connection attempt
Unauthorized injection to a recently created process
Blocking the User Account Control
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/370df6be-2913-428a-a8bc-de402fedb2ce
Result
Threat name:
XpertRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/696960
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to hide a thread from the debugger
Creates an undocumented autostart registry key
Creates autostart registry keys with suspicious names
Detected unpacking (creates a PE file in dynamic memory)
Disables user account control notifications
Found malware configuration
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected Generic Dropper
Yara detected XpertRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 397402 Sample: 92v0MSNtyI.exe Startdate: 25/04/2021 Architecture: WINDOWS Score: 100 62 spapertyy.duckdns.org 2->62 64 ghytrty.duckdns.org 2->64 82 Found malware configuration 2->82 84 Malicious sample detected (through community Yara rule) 2->84 86 Multi AV Scanner detection for submitted file 2->86 88 5 other signatures 2->88 8 92v0MSNtyI.exe 15 4 2->8         started        12 L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0.exe 3 2->12         started        14 L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0.exe 3 2->14         started        16 L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0.exe 2->16         started        signatures3 process4 dnsIp5 70 xwjhdjylqeypyltby.ml 172.67.176.229, 49711, 80 CLOUDFLARENETUS United States 8->70 90 Detected unpacking (creates a PE file in dynamic memory) 8->90 92 Hides threads from debuggers 8->92 94 Injects a PE file into a foreign processes 8->94 96 Contains functionality to hide a thread from the debugger 8->96 18 92v0MSNtyI.exe 1 1 8->18         started        21 WerFault.exe 23 9 8->21         started        24 cmd.exe 1 8->24         started        98 Multi AV Scanner detection for dropped file 12->98 100 Machine Learning detection for dropped file 12->100 26 cmd.exe 1 12->26         started        28 WerFault.exe 12->28         started        31 L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0.exe 1 12->31         started        33 cmd.exe 14->33         started        37 3 other processes 14->37 35 cmd.exe 16->35         started        signatures6 process7 dnsIp8 74 Changes security center settings (notifications, updates, antivirus, firewall) 18->74 76 Disables user account control notifications 18->76 78 Writes to foreign memory regions 18->78 80 2 other signatures 18->80 39 iexplore.exe 3 7 18->39         started        56 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 21->56 dropped 44 conhost.exe 24->44         started        46 timeout.exe 1 24->46         started        48 conhost.exe 26->48         started        50 timeout.exe 1 26->50         started        72 192.168.2.1 unknown unknown 28->72 52 conhost.exe 33->52         started        54 timeout.exe 33->54         started        file9 signatures10 process11 dnsIp12 66 ghytrty.duckdns.org 45.144.225.94, 4145, 49718, 49724 DEDIPATH-LLCUS Netherlands 39->66 68 spapertyy.duckdns.org 39->68 58 L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0.exe, PE32 39->58 dropped 60 C:\...\L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0, data 39->60 dropped 102 Creates an undocumented autostart registry key 39->102 104 Creates autostart registry keys with suspicious names 39->104 file13 signatures14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/29a4c9380a91012be5a2b3659f9a4c46d0eca15c689a95707f78ccde9cd11f02/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-04-25 07:07:06 UTC
AV detection:
11 of 47 (23.40%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fgsmsoakseasxzncwnsz7gsmi3iozik4ncnjk4d7pdgn5hgrd4ba._file
Verdict:
unknown
Similar samples:
128fa77a11cedbe782819f0d2e2666a04e4f8d2966a72f215c77b8933c914a47
XpertRAT
49b1f7e34f74b3ea4b97852292dfd6e856a58f74a181f5a3aadd6356503ae617
XpertRAT
53174a644680154786d09b66cc8c4a1aa83c625bd10137600bf191573fa5c602
XpertRAT
5c32fd3de4bce60a2529cebc5f47b8a1562ea9bd22549f829b22b0533b32f79b
XpertRAT
737b239acfab89839b6bba6e0282a8949b2c1212803e94f76d7d9355b3e377ec
XpertRAT
7c38d073b77ff7afc8f65aac812316d0fa9356115f1f3e78aca9fd496d177cad
XpertRAT
97a6b33da5bd1caba8bf16c1a6457bda8b50ccc25d154962e53d437a8c35661f
XpertRAT
a6c456dcee9a9c53aeb0360bdb52a682137745ad9ec607fce1199e24cd348ee5
XpertRAT
c65e2de75fb34171072925ff6d7c2a9fa79e5d311c4296dacf7a12d524b4167d
XpertRAT
fae8f28a64d1321bc7c90bdadca9edb951cc115bad51fde5347a85d8a6708d3e
XpertRAT
+ 4'799 additional samples on MalwareBazaar
Result
Malware family:
xpertrat
Create hunting rule
Score:
  10/10
Tags:
family:xpertrat evasion persistence rat trojan
Link:
https://tria.ge/reports/210425-nh1rh84pgj/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Windows security modification
Adds policy Run key to start application
UAC bypass
Windows security bypass
XpertRAT
XpertRAT Core Payload
Unpacked files
SH256 hash:
29a4c9380a91012be5a2b3659f9a4c46d0eca15c689a95707f78ccde9cd11f02
MD5 hash:
1f609ed72b74f23379e8d7636b5faa13
SHA1 hash:
439d50691f585b1a3cd674a0852834a97d9fc9cb
Link:
https://www.unpac.me/results/c10ebc2b-45e8-4b04-b5ad-fbcd743c37d7/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_XpertRAT
Create hunting rule
Author:ditekSHen
Description:XpertRAT payload
Rule name:win_xpertrat_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

XpertRAT

Executable exe 29a4c9380a91012be5a2b3659f9a4c46d0eca15c689a95707f78ccde9cd11f02

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1157955/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/144062/

Comments