sectoprat

General

Target

0f9ff9981dca95a05ed1175c668eb0b40a7a994818ac15644ae0f6aa7783ffe0.exe
Size

347KB
Sample

240428-bfhpaach3t
MD5

d77e47afa9745c340bc9503535afcd8e
SHA1

a2e802b8a569c984ab63ba1c6d7ef84fec43c7ec
SHA256

0f9ff9981dca95a05ed1175c668eb0b40a7a994818ac15644ae0f6aa7783ffe0
SHA512

d914d952d6dc55dfcfcfd6efdfaeed289640923c57503c1f4c3c4ddc05fffece43d3afdb1588f00e2a2cf19692c92da2aee91dc4452b97d96a4ff16d2ea422fe
SSDEEP

6144:ToBqFgnH6oK/xcYNKD8r+syjBJw45rtMLYC43J9fa7nxNHnKTf:EawahCYgD8CsKJw4/MchjCnMf

Score

10^/10

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.62

Attributes

url_path
/902e53a07830e030.php

Targets

- Target
  
  0f9ff9981dca95a05ed1175c668eb0b40a7a994818ac15644ae0f6aa7783ffe0.exe
- Size
  
  347KB
- MD5
  
  d77e47afa9745c340bc9503535afcd8e
- SHA1
  
  a2e802b8a569c984ab63ba1c6d7ef84fec43c7ec
- SHA256
  
  0f9ff9981dca95a05ed1175c668eb0b40a7a994818ac15644ae0f6aa7783ffe0
- SHA512
  
  d914d952d6dc55dfcfcfd6efdfaeed289640923c57503c1f4c3c4ddc05fffece43d3afdb1588f00e2a2cf19692c92da2aee91dc4452b97d96a4ff16d2ea422fe
- SSDEEP
  
  6144:ToBqFgnH6oK/xcYNKD8r+syjBJw45rtMLYC43J9fa7nxNHnKTf:EawahCYgD8CsKJw4/MchjCnMf
Score

10^/10

sectoprat stealc zgrat discovery rat spyware stealer trojan
- Detect ZGRat V1
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Detect binaries embedding considerable number of MFA browser extension IDs.
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects encrypted or obfuscated .NET executables
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2