sectoprat

General

Target

627194db7664b17a7a4bb8a492fc269783c0ed3d0b5297577c0b67e9bad7be14
Size

407KB
Sample

240424-s2fkgscf51
MD5

f76286d743961fd81a1c2bd4454c7255
SHA1

79a6660ce2c5a9911a7cdb725b8f2208f7916019
SHA256

627194db7664b17a7a4bb8a492fc269783c0ed3d0b5297577c0b67e9bad7be14
SHA512

93b32c36198c32dbb022482d7724632932b6baa13be52b35aa12ee8760138e336f45e790fedfacd0c935ab474b37e959615753342cb150ad06b73e02b1cb812d
SSDEEP

6144:er74T6TZltEhd+g+/c62Rc1FDvkt+w2TJANHfkYTt9xUo/UPBAK:IET69bEhdJZuDh+kYZ9x8aK

Score

10^/10

Malware Config

Targets

- Target
  
  627194db7664b17a7a4bb8a492fc269783c0ed3d0b5297577c0b67e9bad7be14
- Size
  
  407KB
- MD5
  
  f76286d743961fd81a1c2bd4454c7255
- SHA1
  
  79a6660ce2c5a9911a7cdb725b8f2208f7916019
- SHA256
  
  627194db7664b17a7a4bb8a492fc269783c0ed3d0b5297577c0b67e9bad7be14
- SHA512
  
  93b32c36198c32dbb022482d7724632932b6baa13be52b35aa12ee8760138e336f45e790fedfacd0c935ab474b37e959615753342cb150ad06b73e02b1cb812d
- SSDEEP
  
  6144:er74T6TZltEhd+g+/c62Rc1FDvkt+w2TJANHfkYTt9xUo/UPBAK:IET69bEhdJZuDh+kYZ9x8aK
Score

10^/10

sectoprat stealc rat stealer trojan
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

SectopRAT payload

Stealc

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2