MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XpertRAT


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2
SHA3-384 hash: fd5ce6cce0fb202c98c1ae94c97ceb181bd79f05e5254f1c6327a8f6c0d828fa763abeb3845ed213f283be8586a2391b
SHA1 hash: 0cded80956ed98fff2487cad4d36a24e2f45b41e
MD5 hash: 3f1995ce0816d156a2c4d6ae7bc81c5c
humanhash: iowa-mobile-artist-fix
File name:SecuriteInfo.com.Trojan.Siggen9.42326.15373.13950
Download: download sample
Signature XpertRAT
Create hunting rule
File size:492'544 bytes
First seen:2020-05-01 05:38:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:uIYPUwuH36krheimS6rkv5ulkgOdWVg8LxTN:wt436krRy1lEd
TLSH A3A4E042B6994B33C6C59FB64362F370C33A54375E51E3381DAC64AF3C72B019E9AA46
Reporter SecuriteInfoCom
Tags:XpertRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
908
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.42326.15373.13950.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 04:41:54 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yufq76prjx4rwllkn4hqvad5l4zrvetll42q5pwitakmv4io7pba._file
Verdict:
unknown
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_xpertrat_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

XpertRAT

Executable exe c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/355292/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments