Extracted

• • Target

    df9bf21bdbcd5a27ad3a7d230070135ab62ae4bb4ca18efefaa58d065242bd4d

  • Size

    455KB

  • MD5

    4fe50d7ebbbbc20cd513cc300952a3c8

  • SHA1

    87d218b2066ca1511e2c6659eb2bb29f5b5255e3

  • SHA256

    df9bf21bdbcd5a27ad3a7d230070135ab62ae4bb4ca18efefaa58d065242bd4d

  • SHA512

    78ca6e4c350b182e7c4206b5b15f72110acebc16463dc4b6a36e7271f147936fad9bc990513a11ebaf752a925b8d650e2aa389cfb5909da1cae200aff1efdb03

  • SSDEEP

    6144:wPKlSI6wvdEjpq79xyN+PKbaKNt8RUeW2s4A9YoxYrP9nys3ODE:wylSI66yj4nOaaJh9x6tT3wE

  Score

  10^/10

  sectopratstealcdiscoveryratspywarestealertrojan

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2