MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2926aaea4603961e15c9ac92eb599ddd51bd6e19bd7fded285a1db16753db87. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XpertRAT


Vendor detections: 14


Intelligence 14 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2926aaea4603961e15c9ac92eb599ddd51bd6e19bd7fded285a1db16753db87
SHA3-384 hash: 1db82cfcc34f69c8b71f4750986838574661f8180fa4b93d6f72336011424d97e883fe73f15516e5178fa4270bd26334
SHA1 hash: 447c0d915c9236b5f3221bfbe05e5b57785d3142
MD5 hash: 7560b03d9721036181565287e85d9525
humanhash: east-delaware-orange-queen
File name:7560b03d9721036181565287e85d9525.exe
Download: download sample
Signature XpertRAT
Create hunting rule
File size:1'193'472 bytes
First seen:2021-10-15 07:47:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:wLFftZPKgfM82jk4sM7RPPzN6dK3KEf02oaSzFEvtOA:QZPK3DkktYw3ttyzF2tf
TLSH T1784523D5B09548FAE4DA4AF2E15B982122520C19E038AC7D16ED736A17F377316EBF03
File icon (PE):PE icon
dhash icon 9ee5656565a5a585 (14 x NanoCore, 11 x XpertRAT, 5 x SnakeKeylogger)
Reporter abuse_ch
Tags:exe RAT XpertRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
231
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
REQ PO_0092546 FOR PI.doc
Verdict:
Malicious activity
Analysis date:
2021-10-15 06:56:45 UTC
Tags:
ole-embedded loader trojan rat xpertrat
Link:
https://app.any.run/tasks/735534b4-a20e-4856-905e-73625e104afc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XpertRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/197698/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/616932371c2d58ba7407c02d/reports/5d53e39e-46a4-4f30-9d8b-ed2231c6f72f/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Quasar RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ef903ed4-0137-40e5-9b10-e2f0d8b50f4d
Result
Threat name:
XpertRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/871003
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Changes security center settings (notifications, updates, antivirus, firewall)
Detected unpacking (creates a PE file in dynamic memory)
Disables user account control notifications
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected Generic Dropper
Yara detected XpertRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 503431 Sample: o1dTCi9DbO.exe Startdate: 15/10/2021 Architecture: WINDOWS Score: 100 46 Found malware configuration 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 4 other signatures 2->52 8 o1dTCi9DbO.exe 3 2->8         started        process3 file4 38 C:\Users\user\AppData\...\o1dTCi9DbO.exe, PE32 8->38 dropped 40 C:\Users\...\o1dTCi9DbO.exe:Zone.Identifier, ASCII 8->40 dropped 42 C:\Users\user\AppData\...\o1dTCi9DbO.exe.log, ASCII 8->42 dropped 54 Writes to foreign memory regions 8->54 56 Allocates memory in foreign processes 8->56 58 Injects a PE file into a foreign processes 8->58 12 o1dTCi9DbO.exe 1 1 8->12         started        signatures5 process6 signatures7 60 Multi AV Scanner detection for dropped file 12->60 62 Detected unpacking (creates a PE file in dynamic memory) 12->62 64 Changes security center settings (notifications, updates, antivirus, firewall) 12->64 66 Disables user account control notifications 12->66 15 iexplore.exe 12->15         started        17 iexplore.exe 12->17         started        19 iexplore.exe 12->19         started        21 10 other processes 12->21 process8 process9 23 WerFault.exe 11 15->23         started        26 WerFault.exe 23 11 17->26         started        28 WerFault.exe 2 11 19->28         started        30 WerFault.exe 11 21->30         started        32 WerFault.exe 11 21->32         started        34 WerFault.exe 11 21->34         started        36 4 other processes 21->36 dnsIp10 44 192.168.2.1 unknown unknown 23->44
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f2926aaea4603961e15c9ac92eb599ddd51bd6e19bd7fded285a1db16753db87/
Threat name:
ByteCode-MSIL.Trojan.Bulz
Create hunting rule
Status:
Malicious
First seen:
2021-10-15 05:47:06 UTC
AV detection:
17 of 45 (37.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6kjgvlvema4wdyk4tles5nmz3xkrxvxbtpl733jilio3cz2t3odq._file
Verdict:
malicious
Result
Malware family:
xpertrat
Create hunting rule
Score:
  10/10
Tags:
family:xpertrat collection evasion persistence rat trojan
Link:
https://tria.ge/reports/211015-jm5rdsbddq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System policy modification
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Adds Run key to start application
Checks whether UAC is enabled
Program crash
Deletes itself
Windows security modification
Adds policy Run key to start application
NirSoft MailPassView
Nirsoft
Suspicious use of NtCreateProcessExOtherParentProcess
UAC bypass
Windows security bypass
XpertRAT
Unpacked files
SH256 hash:
4dad2df926ed4fe925713eb9b8fdfdade5bd93a587e9fb4e457df784099d510a
MD5 hash:
8bce22a2be10d7426acd3ee15eb8b95e
SHA1 hash:
07da2335f664e16b4c2b66ec3f143f1a278ce074
Detections:
win_xpertrat_a0
Create hunting rule
win_xpertrat_auto
Create hunting rule
Link:
https://www.unpac.me/results/e4c61e98-a7ce-48eb-8aa6-e12b9c1f8551/
Parent samples :
85f0af15d708b6a2ea67a30f2a858efc9f32af678a5633289c297f588443cd7a
e4b8184869d65a34fb9e0fb43d8b6c252cb153f7139485e3fde6d02cd6898242
c830683f700f311fe3d533d849cf045b1cbed5ff76debaa6c3dd8f71c0daa535
3e77ec2e0bbc394a1841bfb8f9b004f93fcbc35b401580abd01c92c41b6635aa
f2926aaea4603961e15c9ac92eb599ddd51bd6e19bd7fded285a1db16753db87
18bea0cb94e7c9213588f2e8b500d66f4716c0e6ae1b68ec62ba28c64c627ca5
c5a9b54887316170a328f0c1c1adab1db83debfe3b9f922c752c6f090c9abe9b
SH256 hash:
113a9bfe466fca89eb3e714cfc5a280f9682ef5226de5864ed19d8b1bc956ab7
MD5 hash:
f1b61549d25e3270bb40f4fc7f144163
SHA1 hash:
2eae29c525d1a1caca48f4816d8bf853bc913df5
Link:
https://www.unpac.me/results/e4c61e98-a7ce-48eb-8aa6-e12b9c1f8551/
SH256 hash:
36af1513e6ebb49504230c3a64ca364aa1219757c73762ef6c237036f6a605dc
MD5 hash:
f38a2394473b183a6a69d7e69cb3e466
SHA1 hash:
8ff41f162c9dc7608722bf6eaf5032b8d2c72676
Link:
https://www.unpac.me/results/e4c61e98-a7ce-48eb-8aa6-e12b9c1f8551/
SH256 hash:
f2926aaea4603961e15c9ac92eb599ddd51bd6e19bd7fded285a1db16753db87
MD5 hash:
7560b03d9721036181565287e85d9525
SHA1 hash:
447c0d915c9236b5f3221bfbe05e5b57785d3142
Link:
https://www.unpac.me/results/e4c61e98-a7ce-48eb-8aa6-e12b9c1f8551/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/f2926aaea460/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f2926aaea4603961e15c9ac92eb599ddd51bd6e19bd7fded285a1db16753db87

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_XpertRAT
Create hunting rule
Author:ditekSHen
Description:XpertRAT payload
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_xpertrat_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.xpertrat.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

XpertRAT

Executable exe f2926aaea4603961e15c9ac92eb599ddd51bd6e19bd7fded285a1db16753db87

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1649284/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1635439/
  
URLhaus
https://urlhaus.abuse.ch/url/1635950/
Cape
Cape
https://www.capesandbox.com/analysis/197698/

Comments