sectoprat | ecde3ad92330ee31991c576ea937aee9ebba39fa9eada3e5c36e3ab245ce4fab | Triage

Submit
Reports

Overview

overview

Static

static

3

winprofile

windows7-x64

winprofile

windows10-1703-x64

Sharing

General

Target

ecde3ad92330ee31991c576ea937aee9ebba39fa9eada3e5c36e3ab245ce4fab
Size

5.6MB
Sample

240204-elvskshcc4
MD5

b4e0409a6822da1a960bf71ce05fba6f
SHA1

1724cdf0f8c87068414fdadeca2a9562eaedc0ac
SHA256

ecde3ad92330ee31991c576ea937aee9ebba39fa9eada3e5c36e3ab245ce4fab
SHA512

281a3e9d8fdd6617e5d8790990b4e8bf25c7de38673d3404b5e2627221bba1005b3b7ad2c43601663ea523ff5edcbefb9b1d07800fc5001737529182f713494c
SSDEEP

49152:4c/0oszNZcYNMFLlG/lvffs9zNG4Xrzb5u2/EfN8XG0PrmRqeS252B2uPrVKtzwJ:4EszNZctxsN8lTeh5u9uwE+cwL

Score

10^/10

sectoprat discovery rat spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

ecde3ad92330ee31991c576ea937aee9ebba39fa9eada3e5c36e3ab245ce4fab.exe

Resource

win7-20231215-en

sectoprat discovery rat spyware stealer trojan

windows7-x64

12 signatures

300 seconds

Behavioral task

behavioral2

Sample

ecde3ad92330ee31991c576ea937aee9ebba39fa9eada3e5c36e3ab245ce4fab.exe

Resource

win10-20231220-en

sectoprat discovery rat spyware stealer trojan

windows10-1703-x64

12 signatures

300 seconds

Malware Config

Targets

- Target
  
  ecde3ad92330ee31991c576ea937aee9ebba39fa9eada3e5c36e3ab245ce4fab
- Size
  
  5.6MB
- MD5
  
  b4e0409a6822da1a960bf71ce05fba6f
- SHA1
  
  1724cdf0f8c87068414fdadeca2a9562eaedc0ac
- SHA256
  
  ecde3ad92330ee31991c576ea937aee9ebba39fa9eada3e5c36e3ab245ce4fab
- SHA512
  
  281a3e9d8fdd6617e5d8790990b4e8bf25c7de38673d3404b5e2627221bba1005b3b7ad2c43601663ea523ff5edcbefb9b1d07800fc5001737529182f713494c
- SSDEEP
  
  49152:4c/0oszNZcYNMFLlG/lvffs9zNG4Xrzb5u2/EfN8XG0PrmRqeS252B2uPrVKtzwJ:4EszNZctxsN8lTeh5u9uwE+cwL
Score

10^/10

sectoprat discovery rat spyware stealer trojan
- Detects Arechclient2 RAT
  Arechclient2.
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

sectopratdiscoveryratspywarestealertrojan

behavioral2

sectopratdiscoveryratspywarestealertrojan

© 2018-2025

Terms | Privacy