sectoprat

General

Target

cea23a60b4514c147fcc809570e7968514d6d2f16cacfefbecfa6a9813a5bf57
Size

477KB
Sample

240423-2z1mbace8v
MD5

4f4647ae444b0349147451860654f71f
SHA1

8d12555425b1a8cef6fd5ad49aa707592dc73f3b
SHA256

cea23a60b4514c147fcc809570e7968514d6d2f16cacfefbecfa6a9813a5bf57
SHA512

efb9ed1bd1501378a55697cb39df6ebcf1c43ebe1e253ad92f2906c9da994ef03c2e247d0951f6dccea4560d2168615f7206b79eadeee14eed0ae15777006b15
SSDEEP

12288:ICTv4bxSfeTujKcTt7tVCkt8vm8oFoEh1:IFtjalTtSkt8eRoE1

Score

10^/10

Malware Config

Targets

- Target
  
  cea23a60b4514c147fcc809570e7968514d6d2f16cacfefbecfa6a9813a5bf57
- Size
  
  477KB
- MD5
  
  4f4647ae444b0349147451860654f71f
- SHA1
  
  8d12555425b1a8cef6fd5ad49aa707592dc73f3b
- SHA256
  
  cea23a60b4514c147fcc809570e7968514d6d2f16cacfefbecfa6a9813a5bf57
- SHA512
  
  efb9ed1bd1501378a55697cb39df6ebcf1c43ebe1e253ad92f2906c9da994ef03c2e247d0951f6dccea4560d2168615f7206b79eadeee14eed0ae15777006b15
- SSDEEP
  
  12288:ICTv4bxSfeTujKcTt7tVCkt8vm8oFoEh1:IFtjalTtSkt8eRoE1
Score

10^/10

sectoprat stealc zgrat rat stealer trojan
- Detect ZGRat V1
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect ZGRat V1

SectopRAT payload

Stealc

ZGRat

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2