sectoprat

General

Target

681bcda352bda920961a3d6608ca067b7b09f69a9bf41908360c7874219cf443
Size

476KB
Sample

240424-bcsebadd34
MD5

fc2acd2429d8a0da854d4b50d40e2b25
SHA1

d2e32147f0f28b6edb95206256bf669ddd87b601
SHA256

681bcda352bda920961a3d6608ca067b7b09f69a9bf41908360c7874219cf443
SHA512

f8c036c2ac09fe50689a9d0278ad50e9708957399c1edd76485c92a3947cfb82fe38ba2dbab7fa011d5249f1e79014cbce1748c9678a88c88ba23e02a76801dd
SSDEEP

12288:tOlwyGqMW+ccQvLyBxzkLjQSDolWm6NsqwUwoECK:tYEbIuBxwQSEl4NwUworK

Score

10^/10

Malware Config

Targets

- Target
  
  681bcda352bda920961a3d6608ca067b7b09f69a9bf41908360c7874219cf443
- Size
  
  476KB
- MD5
  
  fc2acd2429d8a0da854d4b50d40e2b25
- SHA1
  
  d2e32147f0f28b6edb95206256bf669ddd87b601
- SHA256
  
  681bcda352bda920961a3d6608ca067b7b09f69a9bf41908360c7874219cf443
- SHA512
  
  f8c036c2ac09fe50689a9d0278ad50e9708957399c1edd76485c92a3947cfb82fe38ba2dbab7fa011d5249f1e79014cbce1748c9678a88c88ba23e02a76801dd
- SSDEEP
  
  12288:tOlwyGqMW+ccQvLyBxzkLjQSDolWm6NsqwUwoECK:tYEbIuBxwQSEl4NwUworK
Score

10^/10

sectoprat stealc zgrat rat stealer trojan
- Detect ZGRat V1
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect ZGRat V1

SectopRAT payload

Stealc

ZGRat

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2