sectoprat

General

Target

92f2e5670ccd615c382bed99b427f2d7fda6663f07f70eda2e821ebbd43a667d
Size

386KB
Sample

240427-pj88asba5v
MD5

d3242631de059fe6885ce9ceb42d4b14
SHA1

f3cd21e848a8f7d655f47aaae50550a501821f77
SHA256

92f2e5670ccd615c382bed99b427f2d7fda6663f07f70eda2e821ebbd43a667d
SHA512

e74529955f5d42e838b8ca21e664cd193d2de542356e108ac098c9cf0c2169045892fe6b8e125706a43ff4a1f0fefb9663f91387ae52a84f5d9a90a9e718da44
SSDEEP

6144:USzVvkBage3IgFEbPijF94P0JK4oivly+5Nicq8mDLKQH8q8am6mWK:DZnFEbqBrK7T6ic237XK

Score

10^/10

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.76

Attributes

url_path
/3cd2b41cbde8fc9c.php

Targets

- Target
  
  92f2e5670ccd615c382bed99b427f2d7fda6663f07f70eda2e821ebbd43a667d
- Size
  
  386KB
- MD5
  
  d3242631de059fe6885ce9ceb42d4b14
- SHA1
  
  f3cd21e848a8f7d655f47aaae50550a501821f77
- SHA256
  
  92f2e5670ccd615c382bed99b427f2d7fda6663f07f70eda2e821ebbd43a667d
- SHA512
  
  e74529955f5d42e838b8ca21e664cd193d2de542356e108ac098c9cf0c2169045892fe6b8e125706a43ff4a1f0fefb9663f91387ae52a84f5d9a90a9e718da44
- SSDEEP
  
  6144:USzVvkBage3IgFEbPijF94P0JK4oivly+5Nicq8mDLKQH8q8am6mWK:DZnFEbqBrK7T6ic237XK
Score

10^/10

sectoprat stealc zgrat discovery rat stealer trojan
- Detect ZGRat V1
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

4

T1012

System Information Discovery

4

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect ZGRat V1

SectopRAT payload

Stealc

ZGRat

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2