Overview

overview

10

Static

static

10

88fc7a2297...50.exe

windows7-x64

10

88fc7a2297...50.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    bd395db9ff50281975f579eb162a23c2.bin

  • Size

    3.6MB

  • Sample

    231211-df49dscec5

  • MD5

    c8b7f153fe6888a184c73fe92b40cf0b

  • SHA1

    4248109345f9798f095f145c33efb9d80468dafc

  • SHA256

    2f9a7e2d6909b1f1e548f0aef04eec19adbd241e5fb8cc6a6fe5229f1f1ec786

  • SHA512

    e76bedc8ef6db47ecec78c3b96dfc1dd9626579f4ed41eba7284f043bcff4506276aac9033dfe8277515a1a2e9ebd0c8fd816d2cea0ac595e2c7e37b00494789

  • SSDEEP

    49152:Gk7PssjTWV8ctqjSKhGEB/uAtYqZKo9aAg4VrwYgBU2aYQsGFnymh27AMhkgith7:vPsWiV8SQtEJormBUpsGFjfHr0wloKr

Score
10/10
sectopratzgratdiscoveryratspywarestealertrojan

Malware Config

Targets

    • Target

      88fc7a22979f23640d55e18fd516d6c46e7bfcea1c4e563fe3d51821675ea450.exe

    • Size

      5.5MB

    • MD5

      bd395db9ff50281975f579eb162a23c2

    • SHA1

      1a49b51bf67a171b39c674b11979be4b10e45461

    • SHA256

      88fc7a22979f23640d55e18fd516d6c46e7bfcea1c4e563fe3d51821675ea450

    • SHA512

      212a4f5afe21873e31c2031b0438dd9ecdf8c390143bee4eb27126ed2c730ffb42fa170677c9454c2485185563f734cd6af6eda838a25ecde12981cc3b23435a

    • SSDEEP

      49152:6VeKsNti20GGJy6p8QhE7kqsOj8WoFk+iBt18ecJF2xGX1IzkDolqRsSOjGUaFBY:W8Qh1atub2xoIzLCshGUszXNuBfys

    Score
    10/10
    sectopratzgratdiscoveryratspywarestealertrojan

    • Detect ZGRat V1

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks