sectoprat

General

Target

05242a9fd5c65aabe7fc99189b0bb93e11800d4cd3e05e67b16166ecd9fcb65c
Size

456KB
Sample

240428-kzwjxscd8z
MD5

6141aab05450eda7b3d8e437196c18c5
SHA1

edb57753028a40816d2d783d97696547c317f140
SHA256

05242a9fd5c65aabe7fc99189b0bb93e11800d4cd3e05e67b16166ecd9fcb65c
SHA512

2ba6396d745308dd749508d9af12983204212454014a92a6decc987779f11f434e3f1a969886f4e77c8ce5b48d40e4b29c7ac29bedd58f03daba5c8095bc110b
SSDEEP

6144:Hb1m+ZBBrVw6UuNeqsGqJJ2hUOWXzt1YyQut4Mq75gQ/l67I2XDihjZdz:7c+5vdsGguOt1YyN4MyN/EQZdz

Score

10^/10

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.62

Attributes

url_path
/902e53a07830e030.php

Targets

- Target
  
  05242a9fd5c65aabe7fc99189b0bb93e11800d4cd3e05e67b16166ecd9fcb65c
- Size
  
  456KB
- MD5
  
  6141aab05450eda7b3d8e437196c18c5
- SHA1
  
  edb57753028a40816d2d783d97696547c317f140
- SHA256
  
  05242a9fd5c65aabe7fc99189b0bb93e11800d4cd3e05e67b16166ecd9fcb65c
- SHA512
  
  2ba6396d745308dd749508d9af12983204212454014a92a6decc987779f11f434e3f1a969886f4e77c8ce5b48d40e4b29c7ac29bedd58f03daba5c8095bc110b
- SSDEEP
  
  6144:Hb1m+ZBBrVw6UuNeqsGqJJ2hUOWXzt1YyQut4Mq75gQ/l67I2XDihjZdz:7c+5vdsGguOt1YyN4MyN/EQZdz
Score

10^/10

sectoprat stealc zgrat discovery rat spyware stealer trojan
- Detect ZGRat V1
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2