Overview

overview

10

Static

static

1

0e0bd47371...55.exe

windows7-x64

7

0e0bd47371...55.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e0bd47371b5e50fc51f147dc456949f8db70ec27b6443270b07e05a09e82955.zip

  • Size

    1.5MB

  • Sample

    230321-rvl81sda6s

  • MD5

    c9a17167d98e9ba29d3a291f249c876c

  • SHA1

    bb9c4c81500ce7ab5434f3cdd03c592cb84ebc2f

  • SHA256

    cf0f1dcddd5a8f3eec2417af48ab77f0bc18484028db84ec5751eddd26912aeb

  • SHA512

    68f5e9296c549769673867863ead8ba6de515fd59e80219594dff70064af391c929dd86477ac6105280ac34db937d7390a75b9770caf74ee33edb686117cc5a6

  • SSDEEP

    49152:LGrftUhFvJQh6g1xmLR1AL2jLj8seVIbTsI3:yriveF1xOoC6VaTsI

Score
10/10
sectopratevasionratspywaretrojanupx

Malware Config

Targets

    • Target

      0e0bd47371b5e50fc51f147dc456949f8db70ec27b6443270b07e05a09e82955.exe

    • Size

      1.6MB

    • MD5

      f6de765e9c3c66696dad7d81790aa9cb

    • SHA1

      7416401227b3e746a4f95e0cc3c4c87fedcaf1e2

    • SHA256

      0e0bd47371b5e50fc51f147dc456949f8db70ec27b6443270b07e05a09e82955

    • SHA512

      22d045d940dd251873269a90d9327e081a6495eb4b20741fd2d4a0978038076104fa7221ddee2d06715d84739fd38e5588728308dd00835fd16d425305a148f0

    • SSDEEP

      24576:8WmAFubS0dt9Mcp6YaC02T8ADLdWkn8ikR+8Mx5SpqmxoqDKRtT2ZJyE:w20dRp6Yn04V9WH/O5uqmxhDKRho0E

    Score
    10/10
    upxsectopratevasionratspywaretrojan

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • UAC bypass

      evasiontrojan

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Drops desktop.ini file(s)

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks