sectoprat

General

Target
1f03f591c945989aea4f7060abe04a44.exe
Size 1.0MB
Sample240123-ke97kshea3
SHA256 d1c8da230e62c1bae3b69154d4e2befac79a63574181e4f80cabd05e3b9f782d
MD5 1f03f591c945989aea4f7060abe04a44
SHA1 149b94b6b3b406309830f6b6b9d3b75ad7ccdf65
SHA512 2fd2e0a6a86db48f7dd574414bb5e3843bee5ca3a8cd6170afd29cfe43d61cb99ef587e30d655aa95ddb5fc1e641266e576d5790f822722735c318e336322dd3
SSDEEP 24576:nnRqQWVGLmY2dpmPBrZKBdhwQx6ic0ECxHpwAsQ1jVzqK7:n8fcx9WhlQ0E6mnQ1jVd7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  1f03f591c945989aea4f7060abe04a44.exe
- Size 1.0MB
- SHA256 d1c8da230e62c1bae3b69154d4e2befac79a63574181e4f80cabd05e3b9f782d
- MD5 1f03f591c945989aea4f7060abe04a44
- SHA1 149b94b6b3b406309830f6b6b9d3b75ad7ccdf65
- SHA512 2fd2e0a6a86db48f7dd574414bb5e3843bee5ca3a8cd6170afd29cfe43d61cb99ef587e30d655aa95ddb5fc1e641266e576d5790f822722735c318e336322dd3
- SSDEEP 24576:nnRqQWVGLmY2dpmPBrZKBdhwQx6ic0ECxHpwAsQ1jVzqK7:n8fcx9WhlQ0E6mnQ1jVd7
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

sectoprat discovery rat spyware stealer trojan
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

SectopRAT payload

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2