MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e77ec2e0bbc394a1841bfb8f9b004f93fcbc35b401580abd01c92c41b6635aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XpertRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3e77ec2e0bbc394a1841bfb8f9b004f93fcbc35b401580abd01c92c41b6635aa
SHA3-384 hash: 5dbec81e0a30c5d816158749f34962320cc04f8191bf7d4f8e3e1295867eda3b666aa288dc40d909306990d2196ac9f5
SHA1 hash: c45198609f71e795ccc9e5a2ec1ad3162141da76
MD5 hash: 4ef7b35bd9151fc5538c06ae79a0e2fc
humanhash: freddie-vegan-batman-leopard
File name:4ef7b35bd9151fc5538c06ae79a0e2fc.exe
Download: download sample
Signature XpertRAT
Create hunting rule
File size:1'476'608 bytes
First seen:2021-10-07 12:06:44 UTC
Last seen:2021-10-07 13:13:17 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'653 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 24576:NccWR6EKhvbg2wgVVCW1wq6u6y+gorlj0emV7JKYzj0zX81F03FT:BHw8RrLjlU
Threatray 5'894 similar samples on MalwareBazaar
TLSH T1EE6502FC9513BA7ECBB70DB485E36C9C0C42187B125199E5A88A37C630A3513AF5F46B
File icon (PE):PE icon
dhash icon 9ee5656565a5a585 (14 x NanoCore, 11 x XpertRAT, 5 x SnakeKeylogger)
Reporter abuse_ch
Tags:exe XpertRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
183
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4ef7b35bd9151fc5538c06ae79a0e2fc.exe
Verdict:
Malicious activity
Analysis date:
2021-10-07 12:24:59 UTC
Tags:
trojan rat xpertrat stealer
Link:
https://app.any.run/tasks/3dde0eb6-f091-4de6-b2d6-5b15365e618b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/195836/
Detection(s):
SecuriteInfo.com.Artemis4EF7B35BD915.13430.23334.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching a process
Creating a file in the %temp% directory
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm obfuscated obfuscated packed
Link:
https://www.filescan.io/uploads/615ee2ee98a6280f3933a02d/reports/8b403577-957b-45c7-9baa-d81495c836a2/overview
Malware family:
Quasar RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2c59bc9b-2ee0-4cb5-a7ac-76000c79fc59
Result
Threat name:
XpertRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/866365
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Changes security center settings (notifications, updates, antivirus, firewall)
Creates an undocumented autostart registry key
Creates autostart registry keys with suspicious names
Creates files in the recycle bin to hide itself
Deletes itself after installation
Detected unpacking (creates a PE file in dynamic memory)
Disables user account control notifications
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Writes to foreign memory regions
Yara detected Generic Dropper
Yara detected XpertRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 498791 Sample: PC3aLumBwk.exe Startdate: 07/10/2021 Architecture: WINDOWS Score: 100 65 twitter.com 2->65 81 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->81 83 Found malware configuration 2->83 85 Malicious sample detected (through community Yara rule) 2->85 87 10 other signatures 2->87 10 PC3aLumBwk.exe 4 2->10         started        14 L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe 2->14         started        signatures3 process4 file5 55 C:\Users\user\AppData\...\PC3aLumBwk.exe, PE32 10->55 dropped 57 C:\Users\...\PC3aLumBwk.exe:Zone.Identifier, ASCII 10->57 dropped 59 C:\Users\user\AppData\...\PC3aLumBwk.exe.log, ASCII 10->59 dropped 89 Writes to foreign memory regions 10->89 91 Allocates memory in foreign processes 10->91 93 Injects a PE file into a foreign processes 10->93 16 PC3aLumBwk.exe 10->16         started        19 powershell.exe 70 10->19         started        22 powershell.exe 10->22         started        24 powershell.exe 10->24         started        61 L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe, PE32 14->61 dropped 95 Antivirus detection for dropped file 14->95 97 Multi AV Scanner detection for dropped file 14->97 99 Machine Learning detection for dropped file 14->99 26 powershell.exe 14->26         started        signatures6 process7 dnsIp8 73 Antivirus detection for dropped file 16->73 75 Multi AV Scanner detection for dropped file 16->75 77 Detected unpacking (creates a PE file in dynamic memory) 16->77 79 3 other signatures 16->79 28 iexplore.exe 16->28         started        67 twitter.com 104.244.42.193 TWITTERUS United States 19->67 33 conhost.exe 19->33         started        35 conhost.exe 22->35         started        37 conhost.exe 24->37         started        69 192.168.2.1 unknown unknown 26->69 39 conhost.exe 26->39         started        signatures9 process10 dnsIp11 71 kapasky-antivirus.firewall-gateway.net 91.121.250.249, 4000, 49826, 49827 OVHFR France 28->71 63 L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe, PE32 28->63 dropped 101 Creates files in the recycle bin to hide itself 28->101 103 Creates an undocumented autostart registry key 28->103 105 Creates autostart registry keys with suspicious names 28->105 107 2 other signatures 28->107 41 iexplore.exe 28->41         started        43 iexplore.exe 28->43         started        45 iexplore.exe 28->45         started        47 3 other processes 28->47 file12 signatures13 process14 process15 49 WerFault.exe 41->49         started        51 WerFault.exe 43->51         started        53 WerFault.exe 45->53         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3e77ec2e0bbc394a1841bfb8f9b004f93fcbc35b401580abd01c92c41b6635aa/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-10-07 12:07:32 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
1082af11e2e9949798b1752d511d0c134ccc7bb54147b5c83a5d0edddd236e65
XpertRAT
57a3bde46b00d57d8a57fb821f22843f608ecad6e643a3e8b58d1a3902bb3c0d
XpertRAT
68f58a48d09d07cd851a8d03cef1a6000f715257fbfbad215e22013ac7a7e611
XpertRAT
6c61d18fadb92cf6235f0d9f708f876f8b8bcaaa6eb7d66d5ed515a60a317d94
XpertRAT
97a6b33da5bd1caba8bf16c1a6457bda8b50ccc25d154962e53d437a8c35661f
XpertRAT
ab2261ddf24d2524a3ffe99044fac988f6178be9bc78d28cd5db289c414c3a4f
XpertRAT
b60440f67015b49577c8f2c61231ddd36c5d343373c3798bfc8cc5c2a1ce14f1
XpertRAT
c0fb3989dccc0e8aa3c3b0e95a8b6cc3982c41c80930998efc1ac26613b0153e
XpertRAT
c4f72c811a7b6f83b8cde40cbc757b3ed51eaea7c55edcc6f659389d011687fe
XpertRAT
f8e52fa75724eb08c0ec68db6799740ad36c7178b8f0dd7c8b0ee755ff60c653
XpertRAT
+ 5'884 additional samples on MalwareBazaar
Result
Malware family:
xpertrat
Create hunting rule
Score:
  10/10
Tags:
family:xpertrat botnet:test evasion persistence rat trojan upx
Link:
https://tria.ge/reports/211007-pabwfacegj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Program crash
Deletes itself
Windows security modification
Adds policy Run key to start application
UPX packed file
NirSoft MailPassView
NirSoft WebBrowserPassView
Nirsoft
UAC bypass
Windows security bypass
XpertRAT
XpertRAT Core Payload
Malware Config
C2 Extraction:
kapasky-antivirus.firewall-gateway.net:4000
Unpacked files
SH256 hash:
4dad2df926ed4fe925713eb9b8fdfdade5bd93a587e9fb4e457df784099d510a
MD5 hash:
8bce22a2be10d7426acd3ee15eb8b95e
SHA1 hash:
07da2335f664e16b4c2b66ec3f143f1a278ce074
Detections:
win_xpertrat_a0
Create hunting rule
win_xpertrat_auto
Create hunting rule
Link:
https://www.unpac.me/results/818ec83f-1999-455c-86d8-d8621230d18c/
Parent samples :
85f0af15d708b6a2ea67a30f2a858efc9f32af678a5633289c297f588443cd7a
e4b8184869d65a34fb9e0fb43d8b6c252cb153f7139485e3fde6d02cd6898242
c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535
3e77ec2e0bbc394a1841bfb8f9b004f93fcbc35b401580abd01c92c41b6635aa
f2926aaea4603961e15c9ac92eb599ddd51bd6e19bd7fded285a1db16753db87
18bea0cb94e7c9213588f2e8b500d66f4716c0e6ae1b68ec62ba28c64c627ca5
c5a9b54887316170a328f0c1c1adab1db83debfe3b9f922c752c6f090c9abe9b
SH256 hash:
113a9bfe466fca89eb3e714cfc5a280f9682ef5226de5864ed19d8b1bc956ab7
MD5 hash:
f1b61549d25e3270bb40f4fc7f144163
SHA1 hash:
2eae29c525d1a1caca48f4816d8bf853bc913df5
Link:
https://www.unpac.me/results/818ec83f-1999-455c-86d8-d8621230d18c/
SH256 hash:
6a0c0586d846ac170072a2be35c38332e090ebf11fcfca6a66f662b9861a8a8c
MD5 hash:
88d19cebf533454e67fde3bd2340aede
SHA1 hash:
066d7201e3828cd94e1c4eefc7c4131c0ecc9157
Link:
https://www.unpac.me/results/818ec83f-1999-455c-86d8-d8621230d18c/
SH256 hash:
3e77ec2e0bbc394a1841bfb8f9b004f93fcbc35b401580abd01c92c41b6635aa
MD5 hash:
4ef7b35bd9151fc5538c06ae79a0e2fc
SHA1 hash:
c45198609f71e795ccc9e5a2ec1ad3162141da76
Link:
https://www.unpac.me/results/818ec83f-1999-455c-86d8-d8621230d18c/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/3e77ec2e0bbc/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3e77ec2e0bbc394a1841bfb8f9b004f93fcbc35b401580abd01c92c41b6635aa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

XpertRAT

Executable exe 3e77ec2e0bbc394a1841bfb8f9b004f93fcbc35b401580abd01c92c41b6635aa

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1649284/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1635439/
  
URLhaus
https://urlhaus.abuse.ch/url/1635950/
Cape
Cape
https://www.capesandbox.com/analysis/195836/

Comments