sectoprat

General

Target

0a7871874dc7111b978e798f616211f9.bin
Size

327KB
Sample

240428-bc6a6scd66
MD5

9adc73ffc42feeb984db1078b5aad48c
SHA1

32c19ef472d5e9063614f9d8cd950a2667c1d3b7
SHA256

7f3d710dde55365c2a3d8b67956f1169ede7fdbb5507ba2d185db4fdf4fd014c
SHA512

f44376f70a467c59d8bc8aebe525ef5a1fcd3699d5a7f6ba2558f8b83778d328ec74c1b30c3d8769f32845716b5a92fc73378b12825502692b209376d8a8c1ba
SSDEEP

6144:KglVeSHlViOJKjan0rmoVdC72dBT9O+MDlNyt2G3onrds764QHb7jeZGW+oouS88:KgffH2SnnydbID6tGrS764Q773EgHn

Score

10^/10

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.62

Attributes

url_path
/902e53a07830e030.php

Targets

- Target
  
  209765690105250f9d48d09d6bf6c4bbe22668e38b7b7e400b703e27bec45057.exe
- Size
  
  449KB
- MD5
  
  0a7871874dc7111b978e798f616211f9
- SHA1
  
  5f020eefc6d5da7efecd31bd3911911169d99021
- SHA256
  
  209765690105250f9d48d09d6bf6c4bbe22668e38b7b7e400b703e27bec45057
- SHA512
  
  19b5f8b0f64a0175494d7725875d57cf66a4c90a9fba74e0333f129e1386c6c2458ffc35f4774fad01e8fa2b2ccd59baf56dcc65a27e4f90d42005fe25fbda52
- SSDEEP
  
  12288:UguknPtI9oifhEvyzH3Ig4t5Ri3zg8kQAX6YK1:znFRiySH3Ilt5Ri3rkT6Ye
Score

10^/10

sectoprat stealc zgrat discovery rat spyware stealer trojan
- Detect ZGRat V1
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2