sectoprat

General

Target

3d60b4bf2aaabcf3fd6df8b20f53bc70d5ab961afca5fba8b09ad15ee1bc1995
Size

462KB
Sample

240423-s67jrshf38
MD5

c8b5e7d4514c3b4d1c10e779fc690cb5
SHA1

f2a7569c473c9c27db0144460ebbdd5dc5c742f3
SHA256

3d60b4bf2aaabcf3fd6df8b20f53bc70d5ab961afca5fba8b09ad15ee1bc1995
SHA512

35b999dd651dd1339f5aa80e0b9664bcf8c47160708d4b2f38e691096ef8c8e8ce0afc6d99ace987ccc85bc7b2c0ee623ed23d2981ffe2c6540f12f92bc1bbd1
SSDEEP

6144:HlJTrjFeiyh4RXR+Ll+a6JiZ/I0y7OnE1cOl:HlJTvFlyCR4l+a6Ji5I97TXl

Score

10^/10

Malware Config

Targets

- Target
  
  3d60b4bf2aaabcf3fd6df8b20f53bc70d5ab961afca5fba8b09ad15ee1bc1995
- Size
  
  462KB
- MD5
  
  c8b5e7d4514c3b4d1c10e779fc690cb5
- SHA1
  
  f2a7569c473c9c27db0144460ebbdd5dc5c742f3
- SHA256
  
  3d60b4bf2aaabcf3fd6df8b20f53bc70d5ab961afca5fba8b09ad15ee1bc1995
- SHA512
  
  35b999dd651dd1339f5aa80e0b9664bcf8c47160708d4b2f38e691096ef8c8e8ce0afc6d99ace987ccc85bc7b2c0ee623ed23d2981ffe2c6540f12f92bc1bbd1
- SSDEEP
  
  6144:HlJTrjFeiyh4RXR+Ll+a6JiZ/I0y7OnE1cOl:HlJTvFlyCR4l+a6Ji5I97TXl
Score

10^/10

sectoprat stealc zgrat rat stealer trojan
- Detect ZGRat V1
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect ZGRat V1

SectopRAT payload

Stealc

ZGRat

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2