sectoprat

General

Target

a91b0a8db700951e27f541810e599f3b46eebc2ba1d5da6633a149bbcf4ff171
Size

451KB
Sample

240428-1xf98aab88
MD5

2aa3f11505d5184722916a74ba5e301b
SHA1

b39fd4f91643c66ce575344ed232831a50d0b350
SHA256

a91b0a8db700951e27f541810e599f3b46eebc2ba1d5da6633a149bbcf4ff171
SHA512

646dd1d0f6b3778c336d523262d48e1dd5f6739b7d51872de3fc9a06569c765034e5cb1e1684b1a5ad797305c205f860d282f3a4fc609a714cdbfd4749950f4a
SSDEEP

12288:Dt++0WACRaBnCQ08O0y+li0pUIZ53+gXWN1RUr:ihC1gp+Qk1RUr

Score

10^/10

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes

url_path
/c698e1bc8a2f5e6d.php

Targets

- Target
  
  a91b0a8db700951e27f541810e599f3b46eebc2ba1d5da6633a149bbcf4ff171
- Size
  
  451KB
- MD5
  
  2aa3f11505d5184722916a74ba5e301b
- SHA1
  
  b39fd4f91643c66ce575344ed232831a50d0b350
- SHA256
  
  a91b0a8db700951e27f541810e599f3b46eebc2ba1d5da6633a149bbcf4ff171
- SHA512
  
  646dd1d0f6b3778c336d523262d48e1dd5f6739b7d51872de3fc9a06569c765034e5cb1e1684b1a5ad797305c205f860d282f3a4fc609a714cdbfd4749950f4a
- SSDEEP
  
  12288:Dt++0WACRaBnCQ08O0y+li0pUIZ53+gXWN1RUr:ihC1gp+Qk1RUr
Score

10^/10

sectoprat stealc zgrat discovery rat spyware stealer trojan
- Detect ZGRat V1
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2