sectoprat

General

Target
9fb30ee968261329befe184f245ca0acddfc8e6138aa6540f22645e8e6622228
Size 451KB
Sample240426-s2kjfaef39
SHA256 9fb30ee968261329befe184f245ca0acddfc8e6138aa6540f22645e8e6622228
MD5 67eb66e0a9cf20827192b5f512de7d2d
SHA1 2d927360a2c36c63721a63c35b60b7088b926d36
SHA512 f6971b0b6293412719712b171cf6dfedaffddcd7afbeeddf1ac366215ad35ebedb9c55e087c33844696008e31c37ee0bf3b2632434283061acd662ca7882a061
SSDEEP 12288:ZNI1VGWZEjAGz5QJKKQCX7U/iPIkV38/PQAXycBw:2N0z5QMQLU/iPIQ8nTycBw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  9fb30ee968261329befe184f245ca0acddfc8e6138aa6540f22645e8e6622228
- Size 451KB
- SHA256 9fb30ee968261329befe184f245ca0acddfc8e6138aa6540f22645e8e6622228
- MD5 67eb66e0a9cf20827192b5f512de7d2d
- SHA1 2d927360a2c36c63721a63c35b60b7088b926d36
- SHA512 f6971b0b6293412719712b171cf6dfedaffddcd7afbeeddf1ac366215ad35ebedb9c55e087c33844696008e31c37ee0bf3b2632434283061acd662ca7882a061
- SSDEEP 12288:ZNI1VGWZEjAGz5QJKKQCX7U/iPIkV38/PQAXycBw:2N0z5QMQLU/iPIQ8nTycBw
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

sectoprat zgrat rat trojan
- Detect ZGRat V1
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect ZGRat V1

SectopRAT payload

ZGRat

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2