sectoprat

General

Target

1061fb2b403f061d87c6ffb26f3d22ad7b9729ee72cae1fbc1edb6768a9846bd
Size

476KB
Sample

240423-3bp2cacg64
MD5

40ed4a135ff6f85fdbb9cba095a314f6
SHA1

6a0bbbeac2022c79b93e98d44de00c1edfad3411
SHA256

1061fb2b403f061d87c6ffb26f3d22ad7b9729ee72cae1fbc1edb6768a9846bd
SHA512

24c1b5dfc2f09e21aa83c19d6338a1d6464225ed03b030f40989e14c39c06c85c98a9580c529df77001d9fe23b2b01c5571a08510b3db8cc9312d994a727422f
SSDEEP

12288:0h9wfuSRuFTG7PsvxfbXvLjwDYBYxooECF:0su+wa45bYYBooorF

Score

10^/10

Malware Config

Targets

- Target
  
  1061fb2b403f061d87c6ffb26f3d22ad7b9729ee72cae1fbc1edb6768a9846bd
- Size
  
  476KB
- MD5
  
  40ed4a135ff6f85fdbb9cba095a314f6
- SHA1
  
  6a0bbbeac2022c79b93e98d44de00c1edfad3411
- SHA256
  
  1061fb2b403f061d87c6ffb26f3d22ad7b9729ee72cae1fbc1edb6768a9846bd
- SHA512
  
  24c1b5dfc2f09e21aa83c19d6338a1d6464225ed03b030f40989e14c39c06c85c98a9580c529df77001d9fe23b2b01c5571a08510b3db8cc9312d994a727422f
- SSDEEP
  
  12288:0h9wfuSRuFTG7PsvxfbXvLjwDYBYxooECF:0su+wa45bYYBooorF
Score

10^/10

sectoprat stealc zgrat rat stealer trojan
- Detect ZGRat V1
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect ZGRat V1

SectopRAT payload

Stealc

ZGRat

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2