sectoprat

General

Target

70f9910410ed944750969706a11fece13b6f175e2aea5e1b9ab2e801d3a22cf2
Size

406KB
Sample

240426-fnttqsab94
MD5

dd20c3dea695e4d2bb20f79f2304ea6a
SHA1

a1206a1b16fe30493dfbf782daa603cdd54be867
SHA256

70f9910410ed944750969706a11fece13b6f175e2aea5e1b9ab2e801d3a22cf2
SHA512

ed2a988829f9a1b644b2b3575e5e12c44e239078651544c1f9de8293426dbf288ae664242545c332e55859a0ddd7c183eb2931078c5c5fe039a845eac6a42817
SSDEEP

12288:vnCNuxzdlcGaoloHcJu4ysZCRzh8nkIr3:vCGdleCCgCRCnkIr3

Score

10^/10

Malware Config

Targets

- Target
  
  70f9910410ed944750969706a11fece13b6f175e2aea5e1b9ab2e801d3a22cf2
- Size
  
  406KB
- MD5
  
  dd20c3dea695e4d2bb20f79f2304ea6a
- SHA1
  
  a1206a1b16fe30493dfbf782daa603cdd54be867
- SHA256
  
  70f9910410ed944750969706a11fece13b6f175e2aea5e1b9ab2e801d3a22cf2
- SHA512
  
  ed2a988829f9a1b644b2b3575e5e12c44e239078651544c1f9de8293426dbf288ae664242545c332e55859a0ddd7c183eb2931078c5c5fe039a845eac6a42817
- SSDEEP
  
  12288:vnCNuxzdlcGaoloHcJu4ysZCRzh8nkIr3:vCGdleCCgCRCnkIr3
Score

10^/10

sectoprat stealc zgrat rat stealer trojan
- Detect ZGRat V1
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect ZGRat V1

SectopRAT payload

Stealc

ZGRat

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2