sectoprat

General

Target

ed3cbb28a5610df5a2d0489adcca1fed35a213ba85310f998638279734435eb7
Size

442KB
Sample

240426-l59t6sea7z
MD5

baab4aa164ea2d77b48a6986e912bf3d
SHA1

0ad886cb750824002967e491e94bd96298eb21f4
SHA256

ed3cbb28a5610df5a2d0489adcca1fed35a213ba85310f998638279734435eb7
SHA512

4cbaa101b0e10e739d3e43cac4f4ae86124d3c62c9119d83bd62696c48c7b65807f0c7173542d971f152cfb28c32c9cdbfc45ff6832a0e957df155f817406a87
SSDEEP

12288:8/YF+b8a+KLGNAKq48yhBV2S7PJwwh8na5r:8Qw+1NE48yRZxwNna5r

Score

10^/10

Malware Config

Targets

- Target
  
  ed3cbb28a5610df5a2d0489adcca1fed35a213ba85310f998638279734435eb7
- Size
  
  442KB
- MD5
  
  baab4aa164ea2d77b48a6986e912bf3d
- SHA1
  
  0ad886cb750824002967e491e94bd96298eb21f4
- SHA256
  
  ed3cbb28a5610df5a2d0489adcca1fed35a213ba85310f998638279734435eb7
- SHA512
  
  4cbaa101b0e10e739d3e43cac4f4ae86124d3c62c9119d83bd62696c48c7b65807f0c7173542d971f152cfb28c32c9cdbfc45ff6832a0e957df155f817406a87
- SSDEEP
  
  12288:8/YF+b8a+KLGNAKq48yhBV2S7PJwwh8na5r:8Qw+1NE48yRZxwNna5r
Score

10^/10

sectoprat stealc rat stealer trojan
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

SectopRAT payload

Stealc

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2