Extracted

• • Target
    47307dc63a88e7e1ba5eb0230a0ac39092bd5c284896909d5e9f274f47939483.exe
  • Size 411KB
  • SHA256 47307dc63a88e7e1ba5eb0230a0ac39092bd5c284896909d5e9f274f47939483
  • MD5 74e9f3ba74c619021b87520b083c6a1d
  • SHA1 72db70927e2be7ce030ecb812b9ea241b46d7ad0
  • SHA512 1c8a4b3babdbedf0e9159c6a17e92ad5f1c9ae478d099771b2e775c40ea067cbfc4896d4847a58451484c5500c4df82a979562c944a4fff0c1bea15a841cf120
  • SSDEEP 6144:I+x1ShTyz9EqOq21LVVb7ZpK2FoICp+fGqhDbSe8Lbp779ZLzW6Y:9xo2X2xV1ZpKJICpZqR2bdhc6Y
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcstealersectopratrattrojan

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2