sectoprat

General

Target
ecb694bb378c4841b2ab63d3e96506d4_JaffaCakes118
Size 3.4MB
Sample240411-flft4ach54
SHA256 d7b4b6a43396314d34f68e01bb1dd58a673c97519318f6dd67ee46acace6191e
MD5 ecb694bb378c4841b2ab63d3e96506d4
SHA1 751a02f1e3d3267ea65e86482b9af535709f626f
SHA512 68a672710b9aa7c8c861d69202e1792010d341f6a63889c18c4c003f19131d18b6ba72099a195429874abc1b3a64871759e09f570235d63bcd2555a891d83ca1
SSDEEP 49152:cbLuaZUaBv0TkJ5OiaO7TH2kZ1NapeiVjt+omKUlGl8Nmlxa:4LFyw/OiHjLgeqh+oDD8Nmlg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  ecb694bb378c4841b2ab63d3e96506d4_JaffaCakes118
- Size 3.4MB
- SHA256 d7b4b6a43396314d34f68e01bb1dd58a673c97519318f6dd67ee46acace6191e
- MD5 ecb694bb378c4841b2ab63d3e96506d4
- SHA1 751a02f1e3d3267ea65e86482b9af535709f626f
- SHA512 68a672710b9aa7c8c861d69202e1792010d341f6a63889c18c4c003f19131d18b6ba72099a195429874abc1b3a64871759e09f570235d63bcd2555a891d83ca1
- SSDEEP 49152:cbLuaZUaBv0TkJ5OiaO7TH2kZ1NapeiVjt+omKUlGl8Nmlxa:4LFyw/OiHjLgeqh+oDD8Nmlg
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

sectoprat evasion rat themida trojan
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

SectopRAT payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2