🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6d4f87e9126bf6792e3774f73f9c15e308328bca3f8fcef5f5d943a0904e137. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XpertRAT


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6d4f87e9126bf6792e3774f73f9c15e308328bca3f8fcef5f5d943a0904e137
SHA3-384 hash: 44b08a6ddfaf581212f520cbba026be3e4cc1e50096532294284e73184b6bde9d395670b28f33192255a563c02d4b988
SHA1 hash: 1b0325131df5e081f802f907246da4f2331d60c0
MD5 hash: 5a31075c7e2eede32b52b7e32d16f560
humanhash: venus-helium-kansas-lemon
File name:gunzipped.exe
Download: download sample
Signature XpertRAT
Create hunting rule
File size:634'368 bytes
First seen:2022-05-13 08:41:06 UTC
Last seen:2022-05-13 09:44:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'234 x AgentTesla, 20'488 x Formbook, 12'372 x SnakeKeylogger)
ssdeep 12288:XX3Gk8iP302sxZAT4Bfj0MPZzcYLzsze9bbpP5H8NRX:3CP3AT4hjtPZzJLI8VRuRX
Threatray 973 similar samples on MalwareBazaar
TLSH T11DD4F13DF5E78D22C7182271C0D2180407B0A656A577E7AB2A4610F99D13BEB9DC8FDB
TrID 69.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.9% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe XpertRAT


Avatar
abuse_ch
XpertRAT C2:
79.134.225.106:7091

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
79.134.225.106:7091 https://threatfox.abuse.ch/ioc/554766/

Intelligence

File Origin
# of uploads :
2
# of downloads :
304
Origin country :
n/a
Vendor Threat Intelligence
Detection:
XpertRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/270353/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
Unauthorized injection to a recently created process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/627e19ddae83652f0e9d3d6c/reports/6871bef0-3574-43e9-a0b1-ba710d2e0bbc/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5027efbe-48fb-4197-8f66-4783c2265d2e
Result
Threat name:
XpertRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/993428
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Changes security center settings (notifications, updates, antivirus, firewall)
Detected unpacking (creates a PE file in dynamic memory)
Disables user account control notifications
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected Generic Dropper
Yara detected XpertRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 625925 Sample: gunzipped.exe Startdate: 13/05/2022 Architecture: WINDOWS Score: 100 48 Found malware configuration 2->48 50 Malicious sample detected (through community Yara rule) 2->50 52 Yara detected XpertRAT 2->52 54 6 other signatures 2->54 8 gunzipped.exe 4 2->8         started        process3 file4 44 C:\Users\user\AppData\...\gunzipped.exe.log, ASCII 8->44 dropped 56 Detected unpacking (creates a PE file in dynamic memory) 8->56 58 Adds a directory exclusion to Windows Defender 8->58 60 Injects a PE file into a foreign processes 8->60 12 gunzipped.exe 1 1 8->12         started        15 powershell.exe 22 8->15         started        17 gunzipped.exe 8->17         started        signatures5 process6 signatures7 62 Changes security center settings (notifications, updates, antivirus, firewall) 12->62 64 Disables user account control notifications 12->64 19 iexplore.exe 12->19         started        21 iexplore.exe 12->21         started        23 iexplore.exe 12->23         started        27 8 other processes 12->27 25 conhost.exe 15->25         started        process8 process9 29 WerFault.exe 23 11 19->29         started        32 WerFault.exe 21->32         started        34 WerFault.exe 23->34         started        36 WerFault.exe 27->36         started        38 WerFault.exe 27->38         started        40 WerFault.exe 27->40         started        42 4 other processes 27->42 dnsIp10 46 192.168.2.1 unknown unknown 29->46
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d6d4f87e9126bf6792e3774f73f9c15e308328bca3f8fcef5f5d943a0904e137/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-05-13 08:42:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=23kpq7ure27wpexdo5hxh6oblyyigkf4up4pz327lwkducie4e3q._file
Verdict:
malicious
Similar samples:
325a8b36cd43c91d8a678907611a8ec5c78719809cf1a4cdb3d03f84de59ec50
XpertRAT
79d55a99ff2f41da092fba879ab1858a9f68619c50eb9b65eebb1b45a500e3bb
XpertRAT
8963180e8b2e7e51c5abd716e7a562ad010f663c41a38015ad2566231a7da9af
XpertRAT
8ffc84f1b1316cbcf2e68048631900210632b86e14307c3835ad7a4286bf18d5
XpertRAT
9bd273556358606717f3d0e7d4a2521dba396d6838d8dfccb78bfc5c98590b84
XpertRAT
a3015093b23acb5ee6d0491eca81d6f8b2ad7d9b15181a9366e429e49cf6bf77
XpertRAT
ac0f87add6a605e555dc559282160c2ef708ca2fecc0799442c361c2f37f6828
XpertRAT
bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b
XpertRAT
ff9d837e464eb07ad603c0b2ac0a35029117123c31570baeb61fca9a0242b493
XpertRAT
+ 963 additional samples on MalwareBazaar
Result
Malware family:
xpertrat
Create hunting rule
Score:
  10/10
Tags:
family:xpertrat collection evasion persistence rat trojan
Link:
https://tria.ge/reports/220513-kl1aysghej/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Adds Run key to start application
Checks whether UAC is enabled
Checks computer location settings
Deletes itself
Windows security modification
Adds policy Run key to start application
UAC bypass
Windows security bypass
XpertRAT
Unpacked files
SH256 hash:
d59281f3595f53d815c5af9e4af650cb1f9e7bf2127232c017893b203a86781c
MD5 hash:
f8c671a76b102732659c00b328e7af3b
SHA1 hash:
01977b7800f90b8204b17aed4f810a973066fac7
Detections:
win_xpertrat_a0
Create hunting rule
win_xpertrat_auto
Create hunting rule
Link:
https://www.unpac.me/results/366e9501-338f-4cc3-b17f-fa16b4002e16/
Parent samples :
d37b127c493bbf59bff2017e49513c0f80a5db906715f5e22bbb23d24c2cca3b
0a35b0e0112fc3ffb7fb29e2f7afa092ae3b5932ff8e79c7a9b5365ad5e08013
d6d4f87e9126bf6792e3774f73f9c15e308328bca3f8fcef5f5d943a0904e137
SH256 hash:
fe8f5d4b1865684a48adb3011f9108ee1a8794156a82a1808cc5280b05f5e3d3
MD5 hash:
e4f51d4419aff5249efa837092791bde
SHA1 hash:
5df41370dbeeed3b728da1bb5b7baa67c98d94d0
Link:
https://www.unpac.me/results/366e9501-338f-4cc3-b17f-fa16b4002e16/
SH256 hash:
c206122a7336385be557580c114ac0923192f61bc8f77aa58c898135438399f9
MD5 hash:
6c9e813248a01432890c476813d210b8
SHA1 hash:
fd54aa3af58fc3a88cb3fd6753d773cd6c51b7f8
Link:
https://www.unpac.me/results/366e9501-338f-4cc3-b17f-fa16b4002e16/
SH256 hash:
ccc7da6f979afe84f2e49ce925d84e9530690a6bdc6c95a34e58168bf45afa40
MD5 hash:
770039f909052b612e5c05a3915ab0a3
SHA1 hash:
cb9ce47b9f6016ba9e7fc31aed1e6cb418192760
Link:
https://www.unpac.me/results/366e9501-338f-4cc3-b17f-fa16b4002e16/
SH256 hash:
a3ac53deed403f18bebc2beece8f073b02dac4352b67d357e02feaf04e380893
MD5 hash:
b956114167f8c7de8b364757d729798a
SHA1 hash:
5a1b9c9896db5a7bf5b10887eaea0c2ce0ce06d7
Link:
https://www.unpac.me/results/366e9501-338f-4cc3-b17f-fa16b4002e16/
SH256 hash:
d6d4f87e9126bf6792e3774f73f9c15e308328bca3f8fcef5f5d943a0904e137
MD5 hash:
5a31075c7e2eede32b52b7e32d16f560
SHA1 hash:
1b0325131df5e081f802f907246da4f2331d60c0
Link:
https://www.unpac.me/results/366e9501-338f-4cc3-b17f-fa16b4002e16/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d6d4f87e9126bf6792e3774f73f9c15e308328bca3f8fcef5f5d943a0904e137

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:MALWARE_Win_XpertRAT
Create hunting rule
Author:ditekSHen
Description:XpertRAT payload
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_xpertrat_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.xpertrat.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/270353/

Comments