sectoprat

General

Target

2311b9c48a7252803500270a3f0432ac4cc5f229c414829ce1dfa84736ae1806
Size

452KB
Sample

240427-2lgmaaae2x
MD5

6ab06a7083b80778e10b425845b8184e
SHA1

f9442819679179c43747e2f72df1531b6cfa3135
SHA256

2311b9c48a7252803500270a3f0432ac4cc5f229c414829ce1dfa84736ae1806
SHA512

aaf811a433b0f1c86fcaa96c61f60ad5f98da8ab48ec59cd80b22a4bda06d9bc73fadf8021dfd043efcc01cab846aa04a798aa4c6b50497ddde55a8bbb1e437c
SSDEEP

6144:yqLtuGCSTaLZ4Bz5iNrmY4+wqKKxsnF4rclsMoSkRywnQts4ld:yWtrlXI14qdxsn7T14N4ld

Score

10^/10

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.62

Attributes

url_path
/902e53a07830e030.php

Targets

- Target
  
  2311b9c48a7252803500270a3f0432ac4cc5f229c414829ce1dfa84736ae1806
- Size
  
  452KB
- MD5
  
  6ab06a7083b80778e10b425845b8184e
- SHA1
  
  f9442819679179c43747e2f72df1531b6cfa3135
- SHA256
  
  2311b9c48a7252803500270a3f0432ac4cc5f229c414829ce1dfa84736ae1806
- SHA512
  
  aaf811a433b0f1c86fcaa96c61f60ad5f98da8ab48ec59cd80b22a4bda06d9bc73fadf8021dfd043efcc01cab846aa04a798aa4c6b50497ddde55a8bbb1e437c
- SSDEEP
  
  6144:yqLtuGCSTaLZ4Bz5iNrmY4+wqKKxsnF4rclsMoSkRywnQts4ld:yWtrlXI14qdxsn7T14N4ld
Score

10^/10

sectoprat stealc zgrat discovery rat spyware stealer trojan
- Detect ZGRat V1
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2