sectoprat

General

Target

c7e3680ddd9bef78e9c560e9955586d2
Size

2.5MB
Sample

240314-gy7c9ace7w
MD5

c7e3680ddd9bef78e9c560e9955586d2
SHA1

7865dbdc90deb54e945eb8d8890b48d551ec2241
SHA256

5b667765d8073353f1404e2050d3211d6a346f83fc8fd647d49a3700c1299ae6
SHA512

032d7a9a2bf4e07f3e62338c89e9d2acd25b7234db5ae780d6836124396f1181fc0b9d8563e55468e343ebdcbed98fef21427e2eda37b7cf6c6744a46097dfec
SSDEEP

49152:D8m9uvHDN74Rdctvz0cuXWJabsdxwHzotCiVISQj8ZbYOqoh8tDfFobSJn3HJxhX:gmsvHDNUPQvzH+Wcsdxw04PSQ4ZUOqm4

Score

10^/10

Malware Config

Targets

- Target
  
  c7e3680ddd9bef78e9c560e9955586d2
- Size
  
  2.5MB
- MD5
  
  c7e3680ddd9bef78e9c560e9955586d2
- SHA1
  
  7865dbdc90deb54e945eb8d8890b48d551ec2241
- SHA256
  
  5b667765d8073353f1404e2050d3211d6a346f83fc8fd647d49a3700c1299ae6
- SHA512
  
  032d7a9a2bf4e07f3e62338c89e9d2acd25b7234db5ae780d6836124396f1181fc0b9d8563e55468e343ebdcbed98fef21427e2eda37b7cf6c6744a46097dfec
- SSDEEP
  
  49152:D8m9uvHDN74Rdctvz0cuXWJabsdxwHzotCiVISQj8ZbYOqoh8tDfFobSJn3HJxhX:gmsvHDNUPQvzH+Wcsdxw04PSQ4ZUOqm4
Score

10^/10

sectoprat evasion rat themida trojan
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

SectopRAT payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2