MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85f0af15d708b6a2ea67a30f2a858efc9f32af678a5633289c297f588443cd7a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XpertRAT


Vendor detections: 9


Intelligence 9 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 85f0af15d708b6a2ea67a30f2a858efc9f32af678a5633289c297f588443cd7a
SHA3-384 hash: abb8a17fe033423639ac0b0907a5c255e6fafcbc94e1a793aef4227a80e97f05999b7570caae70075fbf574b65521d76
SHA1 hash: 1d18c71e7e4de5c6216653db5effba586345597c
MD5 hash: f6200b9b9789794de4a8d78f4ae96d22
humanhash: alpha-yankee-ohio-twelve
File name:f6200b9b9789794de4a8d78f4ae96d22.exe
Download: download sample
Signature XpertRAT
Create hunting rule
File size:299'520 bytes
First seen:2021-09-20 12:25:54 UTC
Last seen:2021-09-20 13:01:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:VEbufNiZt9LR3rzPUyv9lYiMikZ/5OQgiLUmU1LAml7LwYiE7hyxcYUUM:TfqLdPPU66iM/Z/8cUmU15cY7acYZM
TLSH T1C554127362504AFDF0285AF7ED73A19686A3F23E686AD37C04C8B4AE0F436716136158
File icon (PE):PE icon
dhash icon 9ee5656565a5a585 (14 x NanoCore, 11 x XpertRAT, 5 x SnakeKeylogger)
Reporter abuse_ch
Tags:exe XpertRAT


Avatar
abuse_ch
XpertRAT C2:
146.59.132.186:4000

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
146.59.132.186:4000 https://threatfox.abuse.ch/ioc/223869/

Intelligence

File Origin
# of uploads :
2
# of downloads :
145
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
IMG_Order PO 094765 SMH.doc
Verdict:
Malicious activity
Analysis date:
2021-09-20 11:40:56 UTC
Tags:
ole-embedded loader
Link:
https://app.any.run/tasks/b752d450-66d0-4000-a2c0-c0a59737895e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/189433/
Detection(s):
SecuriteInfo.com.generic.ml.22837.21520.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8237841d-21ee-41bb-8c9d-6d91c9ac9f12
Result
Threat name:
XpertRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/854028
Signature
Allocates memory in foreign processes
Changes security center settings (notifications, updates, antivirus, firewall)
Detected unpacking (creates a PE file in dynamic memory)
Disables user account control notifications
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Generic Dropper
Yara detected XpertRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 486456 Sample: wikVIeUdvd.exe Startdate: 20/09/2021 Architecture: WINDOWS Score: 100 54 www.twitter.com 2->54 56 www.google.com 2->56 58 3 other IPs or domains 2->58 72 Malicious sample detected (through community Yara rule) 2->72 74 Multi AV Scanner detection for submitted file 2->74 76 Yara detected XpertRAT 2->76 78 3 other signatures 2->78 9 wikVIeUdvd.exe 6 2->9         started        signatures3 process4 file5 48 C:\Users\user\AppData\...\wikVIeUdvd.exe, PE32 9->48 dropped 50 C:\Users\...\wikVIeUdvd.exe:Zone.Identifier, ASCII 9->50 dropped 52 C:\Users\user\AppData\...\wikVIeUdvd.exe.log, ASCII 9->52 dropped 12 wikVIeUdvd.exe 9->12         started        15 powershell.exe 16 9->15         started        18 powershell.exe 19 9->18         started        20 2 other processes 9->20 process6 dnsIp7 80 Multi AV Scanner detection for dropped file 12->80 82 Detected unpacking (creates a PE file in dynamic memory) 12->82 84 Changes security center settings (notifications, updates, antivirus, firewall) 12->84 86 5 other signatures 12->86 22 iexplore.exe 12->22         started        24 iexplore.exe 12->24         started        26 iexplore.exe 12->26         started        36 3 other processes 12->36 60 www.facebook.com 15->60 62 star-mini.c10r.facebook.com 15->62 28 conhost.exe 15->28         started        64 192.168.2.1 unknown unknown 18->64 66 www.google.com 18->66 30 conhost.exe 18->30         started        68 www.twitter.com 20->68 70 twitter.com 20->70 32 conhost.exe 20->32         started        34 conhost.exe 20->34         started        signatures8 process9 process10 38 WerFault.exe 22->38         started        40 WerFault.exe 24->40         started        42 WerFault.exe 26->42         started        44 WerFault.exe 36->44         started        46 WerFault.exe 36->46         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/85f0af15d708b6a2ea67a30f2a858efc9f32af678a5633289c297f588443cd7a/
Threat name:
ByteCode-MSIL.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2021-09-20 12:26:06 UTC
AV detection:
19 of 45 (42.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qxyk6foxbc3kf2thumhsvbmo7sptfl3hrjldgke4ff7vrbcdzv5a._file
Verdict:
malicious
Result
Malware family:
xpertrat
Create hunting rule
Score:
  10/10
Tags:
family:xpertrat botnet:test evasion persistence rat trojan
Link:
https://tria.ge/reports/210920-pl66qaggdk/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Program crash
Deletes itself
Windows security modification
Adds policy Run key to start application
NirSoft MailPassView
NirSoft WebBrowserPassView
Nirsoft
UAC bypass
Windows security bypass
XpertRAT
XpertRAT Core Payload
Malware Config
C2 Extraction:
kapasky-antivirus.firewall-gateway.net:4000
Unpacked files
SH256 hash:
4dad2df926ed4fe925713eb9b8fdfdade5bd93a587e9fb4e457df784099d510a
MD5 hash:
8bce22a2be10d7426acd3ee15eb8b95e
SHA1 hash:
07da2335f664e16b4c2b66ec3f143f1a278ce074
Detections:
win_xpertrat_a0
Create hunting rule
win_xpertrat_auto
Create hunting rule
Link:
https://www.unpac.me/results/18ff30f9-d44c-469f-851a-1406a7295f62/
Parent samples :
85f0af15d708b6a2ea67a30f2a858efc9f32af678a5633289c297f588443cd7a
e4b8184869d65a34fb9e0fb43d8b6c252cb153f7139485e3fde6d02cd6898242
c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535
3e77ec2e0bbc394a1841bfb8f9b004f93fcbc35b401580abd01c92c41b6635aa
f2926aaea4603961e15c9ac92eb599ddd51bd6e19bd7fded285a1db16753db87
18bea0cb94e7c9213588f2e8b500d66f4716c0e6ae1b68ec62ba28c64c627ca5
c5a9b54887316170a328f0c1c1adab1db83debfe3b9f922c752c6f090c9abe9b
SH256 hash:
c39e3568196e2241d7954fa3f88d5bf93c34d4c77847e9501bfed3393930818f
MD5 hash:
ebb3e1a9719f19e6697bb45fe763df2c
SHA1 hash:
fcc843409ccf3b963a4dc6e76460a1e42f763df7
Link:
https://www.unpac.me/results/18ff30f9-d44c-469f-851a-1406a7295f62/
SH256 hash:
47ae86d7eee8091b0340a34500ce8ca57b23b5a60f5312be1e01b3d0a2b6f605
MD5 hash:
5523e00ac5b7b98318ba4a96a147f53c
SHA1 hash:
6a1197eda07cabf9c1639ab970afce075babd511
Link:
https://www.unpac.me/results/18ff30f9-d44c-469f-851a-1406a7295f62/
SH256 hash:
85f0af15d708b6a2ea67a30f2a858efc9f32af678a5633289c297f588443cd7a
MD5 hash:
f6200b9b9789794de4a8d78f4ae96d22
SHA1 hash:
1d18c71e7e4de5c6216653db5effba586345597c
Link:
https://www.unpac.me/results/18ff30f9-d44c-469f-851a-1406a7295f62/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/85f0af15d708b6a2ea67a30f2a858efc9f32af678a5633289c297f588443cd7a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

XpertRAT

Executable exe 85f0af15d708b6a2ea67a30f2a858efc9f32af678a5633289c297f588443cd7a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1635439/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/189433/
  
URLhaus
https://urlhaus.abuse.ch/url/1635950/

Comments