Extracted

• • Target
    ad75a5e08b52342c80ad44cc715d086365053b53cb58b571db9f80fafb92c01b
  • Size 418KB
  • SHA256 ad75a5e08b52342c80ad44cc715d086365053b53cb58b571db9f80fafb92c01b
  • MD5 2cd9e853d0b4397d29cc9e0d5810c73d
  • SHA1 13d4b8430d8c296334b8489ffbad21e88dadc0df
  • SHA512 1d4aac3344f9dc5d0a157441499c1204b5ca65f3f640a18b820933dfad219c1f44c30e2158cc57fd3bc343c7cb9dc16de78aa8963454fe98a23350c2db1bd0ac
  • SSDEEP 6144:77moGeb6RptVKAv+9sWfx/eLmt6SAQeVTEu680BXs+tTbA:77+ebCV9LWfx/zUSKVQushT8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  sectopratstealcdiscoveryratstealertrojan

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2