sectoprat

General

Target

c53639713fc373fabad80a7e93956ab8.exe
Size

456KB
Sample

240428-llgdhscg47
MD5

c53639713fc373fabad80a7e93956ab8
SHA1

fdd3a2094699e5b9326b418e995c7ac1b15e2d89
SHA256

8380469f59a99421ac025c84ac03141e73843d97885b2681474f185ba12796b3
SHA512

5ec1304438737f35f29aed12209f2df14386f844d8424335acc851f49a2277f4cee7cb0277de64bfff2e5cc70724a827a6bc636b02dc61b3f87d4763a369f71b
SSDEEP

6144:Hb1m+ZBBrVw6UuNeqsGqJJ2hUOWXzt1YyQut4Mq75gQ/l67I2XDihjZd+:7c+5vdsGguOt1YyN4MyN/EQZd+

Score

10^/10

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.62

Attributes

url_path
/902e53a07830e030.php

Targets

- Target
  
  c53639713fc373fabad80a7e93956ab8.exe
- Size
  
  456KB
- MD5
  
  c53639713fc373fabad80a7e93956ab8
- SHA1
  
  fdd3a2094699e5b9326b418e995c7ac1b15e2d89
- SHA256
  
  8380469f59a99421ac025c84ac03141e73843d97885b2681474f185ba12796b3
- SHA512
  
  5ec1304438737f35f29aed12209f2df14386f844d8424335acc851f49a2277f4cee7cb0277de64bfff2e5cc70724a827a6bc636b02dc61b3f87d4763a369f71b
- SSDEEP
  
  6144:Hb1m+ZBBrVw6UuNeqsGqJJ2hUOWXzt1YyQut4Mq75gQ/l67I2XDihjZd+:7c+5vdsGguOt1YyN4MyN/EQZd+
Score

10^/10

sectoprat stealc zgrat discovery rat stealer trojan
- Detect ZGRat V1
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect ZGRat V1

SectopRAT payload

Stealc

ZGRat

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2