sectoprat

General

Target

069bebac87e5c2bf6e4c4bfb52a8731e1a98867a3bf1214e56da9ee7f86a62ec.exe
Size

347KB
Sample

240428-bdtnrscg6z
MD5

d14f4b8b71b645f1f6b3ec2530d9c2d0
SHA1

c62d3a73ecff3337e59d1ecfcbfd3da77a8ca933
SHA256

069bebac87e5c2bf6e4c4bfb52a8731e1a98867a3bf1214e56da9ee7f86a62ec
SHA512

979b3f4faadf1ef7cf97d9d1fac1518c5307e10ee52a2c74406282f95c1811b075b226029fc5ceb56e1104ed1d43c2db51ed2d9a37d9153a8a532b0bd8683457
SSDEEP

6144:8o+4WgjZb/JFOtrrcQfDowFsTPgZvaRGbmDgAsWrJhUN5m8BOF:5ZjZb/JfQboRTAvaYykBAfFF

Score

10^/10

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.62

Attributes

url_path
/902e53a07830e030.php

Targets

- Target
  
  069bebac87e5c2bf6e4c4bfb52a8731e1a98867a3bf1214e56da9ee7f86a62ec.exe
- Size
  
  347KB
- MD5
  
  d14f4b8b71b645f1f6b3ec2530d9c2d0
- SHA1
  
  c62d3a73ecff3337e59d1ecfcbfd3da77a8ca933
- SHA256
  
  069bebac87e5c2bf6e4c4bfb52a8731e1a98867a3bf1214e56da9ee7f86a62ec
- SHA512
  
  979b3f4faadf1ef7cf97d9d1fac1518c5307e10ee52a2c74406282f95c1811b075b226029fc5ceb56e1104ed1d43c2db51ed2d9a37d9153a8a532b0bd8683457
- SSDEEP
  
  6144:8o+4WgjZb/JFOtrrcQfDowFsTPgZvaRGbmDgAsWrJhUN5m8BOF:5ZjZb/JfQboRTAvaYykBAfFF
Score

10^/10

sectoprat stealc zgrat discovery rat spyware stealer trojan
- Detect ZGRat V1
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Detect binaries embedding considerable number of MFA browser extension IDs.
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects encrypted or obfuscated .NET executables
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2