MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59c441437848b229ccf0ea69598b83e3be1664779a9c7a71142e69fc73a005fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XpertRAT


Vendor detections: 9


Intelligence 9 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 59c441437848b229ccf0ea69598b83e3be1664779a9c7a71142e69fc73a005fc
SHA3-384 hash: 5d88c409c7917df482a6548bee0e7fc8110587d891220cf01976d980c6dc9d0a0e591706f0bc772e8706f7ca4b446f3a
SHA1 hash: 425c492897eaf59eb30a96fb2229285b6076b423
MD5 hash: 0344d6ec47d85e81c4346f14bad096c4
humanhash: don-august-queen-maryland
File name:0344d6ec47d85e81c4346f14bad096c4.exe
Download: download sample
Signature XpertRAT
Create hunting rule
File size:97'792 bytes
First seen:2021-04-21 07:21:54 UTC
Last seen:2021-04-21 08:02:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 1536:L/VYZboVlbED+9T2zMZCL8HvDZi1WvLGK331DV6eC31K9R:LNm0VlbED+9UMEL8HVimLGK3FDV6eu1E
Threatray 5'008 similar samples on MalwareBazaar
TLSH 7CA34CC0711648C4EBAFF2398A3A75950B7083310DB898E7B3ED71B186477651EC5FAA
Reporter abuse_ch
Tags:exe XpertRAT


Avatar
abuse_ch
XpertRAT C2:
45.144.225.94:4145

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
45.144.225.94:4145 https://threatfox.abuse.ch/ioc/9354/

Intelligence

File Origin
# of uploads :
2
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0344d6ec47d85e81c4346f14bad096c4.exe
Verdict:
Malicious activity
Analysis date:
2021-04-21 07:35:19 UTC
Tags:
trojan dtloader loader
Link:
https://app.any.run/tasks/d2c1a4a7-71e4-43e0-ab6e-f0a926fe23a1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/141878/
Detection(s):
SecuriteInfo.com.Trojan.DownloaderNET.160.14193.3361.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Creating a file
Running batch commands
Creating a process with a hidden window
Launching a process
Adding an access-denied ACE
Creating a window
Launching the default Windows debugger (dwwin.exe)
Sending a UDP request
Unauthorized injection to a recently created process
Blocking the User Account Control
Unauthorized injection to a recently created process by context flags manipulation
Sending an HTTP GET request to an infection source
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
MailPassView XpertRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/690516
Signature
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to hide a thread from the debugger
Creates an undocumented autostart registry key
Creates autostart registry keys with suspicious names
Detected unpacking (creates a PE file in dynamic memory)
Disables user account control notifications
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Tries to steal Mail credentials (via file registry)
Uses dynamic DNS services
Yara detected Generic Dropper
Yara detected MailPassView
Yara detected WebBrowserPassView password recovery tool
Yara detected XpertRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 394200 Sample: muZnCwLVVs.exe Startdate: 21/04/2021 Architecture: WINDOWS Score: 100 62 Multi AV Scanner detection for domain / URL 2->62 64 Malicious sample detected (through community Yara rule) 2->64 66 Multi AV Scanner detection for submitted file 2->66 68 7 other signatures 2->68 9 muZnCwLVVs.exe 15 4 2->9         started        13 L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0.exe 14 4 2->13         started        15 L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0.exe 2->15         started        17 L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0.exe 2->17         started        process3 dnsIp4 58 mmwrlridbhmibnr.ml 104.21.86.143, 49709, 49724, 49726 CLOUDFLARENETUS United States 9->58 74 Detected unpacking (creates a PE file in dynamic memory) 9->74 76 Hides threads from debuggers 9->76 78 Injects a PE file into a foreign processes 9->78 80 Contains functionality to hide a thread from the debugger 9->80 19 muZnCwLVVs.exe 1 1 9->19         started        22 WerFault.exe 23 9 9->22         started        25 cmd.exe 1 9->25         started        82 Machine Learning detection for dropped file 13->82 27 cmd.exe 13->27         started        signatures5 process6 file7 70 Changes security center settings (notifications, updates, antivirus, firewall) 19->70 72 Disables user account control notifications 19->72 29 iexplore.exe 3 8 19->29         started        34 iexplore.exe 19->34         started        54 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 22->54 dropped 36 conhost.exe 25->36         started        38 timeout.exe 1 25->38         started        40 conhost.exe 27->40         started        signatures8 process9 dnsIp10 60 ghytrty.duckdns.org 45.144.225.94, 4145, 49714, 49715 DEDIPATH-LLCUS Netherlands 29->60 56 L3Q7I4T2-J8A6-K6O4-W4G3-T5J7D0W2V5E0.exe, PE32 29->56 dropped 84 Creates an undocumented autostart registry key 29->84 86 Creates autostart registry keys with suspicious names 29->86 42 iexplore.exe 29->42         started        44 iexplore.exe 1 29->44         started        46 iexplore.exe 29->46         started        50 3 other processes 29->50 48 WerFault.exe 34->48         started        file11 signatures12 process13 process14 52 WerFault.exe 42->52         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/59c441437848b229ccf0ea69598b83e3be1664779a9c7a71142e69fc73a005fc/
Threat name:
ByteCode-MSIL.Trojan.Phonzy
Create hunting rule
Status:
Malicious
First seen:
2021-04-21 07:37:03 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lhcecq3yjczctthq5juvtc4d4o7bmzdxtkohu4iufzu7y45aax6a._file
Verdict:
malicious
Similar samples:
128fa77a11cedbe782819f0d2e2666a04e4f8d2966a72f215c77b8933c914a47
XpertRAT
49b1f7e34f74b3ea4b97852292dfd6e856a58f74a181f5a3aadd6356503ae617
XpertRAT
53174a644680154786d09b66cc8c4a1aa83c625bd10137600bf191573fa5c602
XpertRAT
737b239acfab89839b6bba6e0282a8949b2c1212803e94f76d7d9355b3e377ec
XpertRAT
7c38d073b77ff7afc8f65aac812316d0fa9356115f1f3e78aca9fd496d177cad
XpertRAT
8179d2c371934e7f748fdf033d96a3b527158348e87ec21f1576136ede5d2d17
XpertRAT
97a6b33da5bd1caba8bf16c1a6457bda8b50ccc25d154962e53d437a8c35661f
XpertRAT
a6c456dcee9a9c53aeb0360bdb52a682137745ad9ec607fce1199e24cd348ee5
XpertRAT
c65e2de75fb34171072925ff6d7c2a9fa79e5d311c4296dacf7a12d524b4167d
XpertRAT
fae8f28a64d1321bc7c90bdadca9edb951cc115bad51fde5347a85d8a6708d3e
XpertRAT
+ 4'998 additional samples on MalwareBazaar
Result
Malware family:
xpertrat
Create hunting rule
Score:
  10/10
Tags:
family:xpertrat evasion persistence rat trojan upx
Link:
https://tria.ge/reports/210421-1blmakj2m2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System policy modification
Delays execution with timeout.exe
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Windows security modification
Adds policy Run key to start application
UPX packed file
NirSoft MailPassView
NirSoft WebBrowserPassView
Nirsoft
UAC bypass
Windows security bypass
XpertRAT
XpertRAT Core Payload
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/59c441437848b229ccf0ea69598b83e3be1664779a9c7a71142e69fc73a005fc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_XpertRAT
Create hunting rule
Author:ditekSHen
Description:XpertRAT payload
Rule name:win_xpertrat_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

XpertRAT

Executable exe 59c441437848b229ccf0ea69598b83e3be1664779a9c7a71142e69fc73a005fc

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/141878/
  
URLhaus
https://urlhaus.abuse.ch/url/1145250/
  
Delivery method
Distributed via web download

Comments