sectoprat

General

Target

ac075dc158427a98750ca956666c2a7d8d25fe67cbf3512dafbab2c1d64c8018.exe
Size

347KB
Sample

240428-b9dbnade64
MD5

99ad2380a2037d5f6abbdaa7eb19d6f2
SHA1

8ff97702269d282ced94b4f832116a7c9189b7e8
SHA256

ac075dc158427a98750ca956666c2a7d8d25fe67cbf3512dafbab2c1d64c8018
SHA512

623ca4e8c36631dbc242b18b012f7231a68d8605782a0d9dccbb6a63a73da743eb26ed60f44d68f055d7990f4bc4e41fa9070101aac582b16a60c63e8e4c753b
SSDEEP

6144:8o+4WgjZb/JFOtrrcQfDowFsTPgZvaRGbmDgAsWrJhUN5m8BOK:5ZjZb/JfQboRTAvaYykBAfFK

Score

10^/10

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.62

Attributes

url_path
/902e53a07830e030.php

Targets

- Target
  
  ac075dc158427a98750ca956666c2a7d8d25fe67cbf3512dafbab2c1d64c8018.exe
- Size
  
  347KB
- MD5
  
  99ad2380a2037d5f6abbdaa7eb19d6f2
- SHA1
  
  8ff97702269d282ced94b4f832116a7c9189b7e8
- SHA256
  
  ac075dc158427a98750ca956666c2a7d8d25fe67cbf3512dafbab2c1d64c8018
- SHA512
  
  623ca4e8c36631dbc242b18b012f7231a68d8605782a0d9dccbb6a63a73da743eb26ed60f44d68f055d7990f4bc4e41fa9070101aac582b16a60c63e8e4c753b
- SSDEEP
  
  6144:8o+4WgjZb/JFOtrrcQfDowFsTPgZvaRGbmDgAsWrJhUN5m8BOK:5ZjZb/JfQboRTAvaYykBAfFK
Score

10^/10

sectoprat stealc zgrat discovery rat spyware stealer trojan
- Detect ZGRat V1
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Detect binaries embedding considerable number of MFA browser extension IDs.
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects encrypted or obfuscated .NET executables
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2