sectoprat

General

Target

47134c68fce464e80209ddaffc71e17ac4852fd4ec6f26ffcf75e461ab6adc29
Size

451KB
Sample

240428-t9e5csca98
MD5

c58df82b7146e046d56980fed1a9f4be
SHA1

a9c2a18f46a39dd6dcb7d61106ffedd4861f10b1
SHA256

47134c68fce464e80209ddaffc71e17ac4852fd4ec6f26ffcf75e461ab6adc29
SHA512

21c9dbec7cfe63076b4c279574ade07c0ecfac6670edeae79bedf6a1b1cf2d4f396b3fef64233cc1b6cb14864930ab063081c398db0aba19f66b54778460b3af
SSDEEP

6144:EbizKU6CpA9+9+HDs15JInfn07l7Ro9+mdb7nrAUYj9To2BwMt2jBse7NUn:EbMKUHmcQs7Po9+esUYjq2SUUTBUn

Score

10^/10

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes

url_path
/c698e1bc8a2f5e6d.php

Targets

- Target
  
  47134c68fce464e80209ddaffc71e17ac4852fd4ec6f26ffcf75e461ab6adc29
- Size
  
  451KB
- MD5
  
  c58df82b7146e046d56980fed1a9f4be
- SHA1
  
  a9c2a18f46a39dd6dcb7d61106ffedd4861f10b1
- SHA256
  
  47134c68fce464e80209ddaffc71e17ac4852fd4ec6f26ffcf75e461ab6adc29
- SHA512
  
  21c9dbec7cfe63076b4c279574ade07c0ecfac6670edeae79bedf6a1b1cf2d4f396b3fef64233cc1b6cb14864930ab063081c398db0aba19f66b54778460b3af
- SSDEEP
  
  6144:EbizKU6CpA9+9+HDs15JInfn07l7Ro9+mdb7nrAUYj9To2BwMt2jBse7NUn:EbMKUHmcQs7Po9+esUYjq2SUUTBUn
Score

10^/10

sectoprat stealc zgrat discovery rat spyware stealer trojan
- Detect ZGRat V1
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2