Rewterz Threat Alert – Malspam campaign dropping XpertRAT Malware via ISO images

Friday, July 12, 2019



Analysis Summary

An email campaign spreading XpertRAT via ISO images with advanced anti-analysis techniques. The phishing email in this campaign mimics a well-known Italian manufacturing company. Attached is an ISO file packed with a Delphi packer, which the researchers note will mount natively to the file system if it is running Windows 8 or above. The malicious payload is stored in the resource section of the ISO as encrypted data. Before the final payload is executed on the system, the malware performs a series of checks for anti-analysis purposes. First, it checks for whether a debugger is attached to the malicious process. Then it checks for cursor movements, indicating real user activity. Next, it checks information about the CPU in order to identify whether the system is running on a hypervisor. The list of running processes is then checked for analysis tools or anti-malware products. Finally, the file path of the EXE is checked for keywords, such as “sandbox”, “sample”, and more. If all the checks are successful, the final payload is injected into a new “iexplore.exe” process. This payload was identified to be XpertRAT. Once it has been installed and has established persistence, it attempts to communicate with its C2.



  • Keylogging
  • Command execution

Indicators of Compromise

IP(s) / Hostname(s)






Malware Hash (MD5/SHA1/SH256)

  • 3fec3cfb179c80e16c68c79b17970e8cb1f1470cd3b786bfc70f91e0632d0208
  • 3c249ea5120fdccc8254db0e0fe8a91e21a9d3d53d90a264a34278f13b1796fe


  • Block all threat indicators at your respective controls.
  • Always be suspicious about emails sent by unknown senders.
  • Never click on the link/attachments sent by unknown senders.

Data Sheets

Corporate Brochure

Our Story



Managed Security

Upcoming Rewterz Trainings/Events

Rewterz News

  • 11, October 2019 Rewterz Threat Alert – Kimsuky Group – IOC’s
  • 11, October 2019 Rewterz Threat Advisory – CVE-2019-10936 – Siemens PROFINET Devices Denial of Service Vulnerability
  • 11, October 2019 Rewterz Threat Advisory – CVE-2019-10923 – Siemens Industrial Real-Time (IRT) Devices DoS Vulnerability
  • 10, October 2019 Rewterz Threat Alert – Another Agenttesla campaign using a compromised Iraq Government site

Copyright © Rewterz. All rights reserved.