Overview

overview

10

Static

static

3

b8a0f9eb3d...16.exe

windows7-x64

10

b8a0f9eb3d...16.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    36bd43b2792ce1ea475f91074eb2ef61.bin

  • Size

    3.4MB

  • Sample

    231128-b2awkaec28

  • MD5

    b4403777e12582491f4923140221e01e

  • SHA1

    4d88b3104d25f19f12fc2872364d3085e16c7bbe

  • SHA256

    9d9ef903c05798b54500a8e3ba5c12ad43836be46d473ff37311f6e573b3b4ec

  • SHA512

    b452d22bfb618a53ee411f3345217b71d94d118e14dea2f3e17dd553ca0810d5e2f180bd9c20ded3b62303ebcdaceb0554926d43de82da025a32152e19c75104

  • SSDEEP

    98304:9iSGtWiPLnoeGtXCaou68QtMo7CaPOv3JyJ7:Pcx2RPQmk7

Score
10/10
sectopratdiscoveryratspywarestealertrojan

Malware Config

Targets

    • Target

      b8a0f9eb3dbf5e78c15777915fdb57b44748c1ece2d1c0e89cc2da8706ef7e16.exe

    • Size

      5.8MB

    • MD5

      36bd43b2792ce1ea475f91074eb2ef61

    • SHA1

      5cec1de19dc29bdc5b1e8b1b407df49bcf570fa2

    • SHA256

      b8a0f9eb3dbf5e78c15777915fdb57b44748c1ece2d1c0e89cc2da8706ef7e16

    • SHA512

      c27346ddddf4dd74c34c49a1af06102a4ff7c6d1ddfe0282065caa19c359e0b04b02a61647e2dd65bc59e003874aa6e9a2101a7088dec4ed8106bcbfcc8f15e3

    • SSDEEP

      98304:HbJtyoEqHYztcfN3Ks24t5TPC3oRdZci:NVBHEtcfBKKDzZci

    Score
    10/10
    sectopratdiscoveryratspywarestealertrojan

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks