sectoprat

General

Target

3ca19ffd709a009ce797a5c3eb20079277e1d4c51e27cb7795b8adb82e3def52
Size

406KB
Sample

240425-e1lhfsfd4s
MD5

2edc987ac839461950867bd2fd0e8895
SHA1

18aaf4861dfaa61de13eed31004ff92fa5d7e065
SHA256

3ca19ffd709a009ce797a5c3eb20079277e1d4c51e27cb7795b8adb82e3def52
SHA512

63dbf325d932e507916b48b90eb4a5c6ece04b4f5dc597b8c2176b6123b5f29ca37ce2f70b2e3a73d2826865391725bc081682e5154f706f9f0eb7b75e17bebe
SSDEEP

6144:ZAuhQxtgcHEOgazi/NtXZ8mzVoq/6Jj4M2T1sRg9ivUUfFURO6dEL4tOKrS:ZAuhQTg22NzVoPSMSsRkUfu/dELuOKrS

Score

10^/10

Malware Config

Targets

- Target
  
  3ca19ffd709a009ce797a5c3eb20079277e1d4c51e27cb7795b8adb82e3def52
- Size
  
  406KB
- MD5
  
  2edc987ac839461950867bd2fd0e8895
- SHA1
  
  18aaf4861dfaa61de13eed31004ff92fa5d7e065
- SHA256
  
  3ca19ffd709a009ce797a5c3eb20079277e1d4c51e27cb7795b8adb82e3def52
- SHA512
  
  63dbf325d932e507916b48b90eb4a5c6ece04b4f5dc597b8c2176b6123b5f29ca37ce2f70b2e3a73d2826865391725bc081682e5154f706f9f0eb7b75e17bebe
- SSDEEP
  
  6144:ZAuhQxtgcHEOgazi/NtXZ8mzVoq/6Jj4M2T1sRg9ivUUfFURO6dEL4tOKrS:ZAuhQTg22NzVoPSMSsRkUfu/dELuOKrS
Score

10^/10

sectoprat stealc zgrat rat stealer trojan
- Detect ZGRat V1
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect ZGRat V1

SectopRAT payload

Stealc

ZGRat

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2