sectoprat

General

Target

5bb83f0ba00575c13ebd140a39a6f08a109e262dcadf5d6acf1e1df06dfd2192
Size

457KB
Sample

240428-kep7eabh9v
MD5

b8cada23248c735be688419576776c79
SHA1

560bcac9ae8062b07e6fca1db673b19b7d44c41a
SHA256

5bb83f0ba00575c13ebd140a39a6f08a109e262dcadf5d6acf1e1df06dfd2192
SHA512

f167e6b70893ffbe8f4ec77089bee4a2145d3faa9e084a96493ade518e0a2f008faaf1607cced683f2a5d0acfc2851e0e1eebc33b812ec5b2c1a00227e427f6d
SSDEEP

6144:xH1aphP6ZxqlnU3ijOJj58v9X6/7rYlce7nVElm2Et6pdF:xVanaIlnUBKvF64lVXupdF

Score

10^/10

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.62

Attributes

url_path
/902e53a07830e030.php

Targets

- Target
  
  5bb83f0ba00575c13ebd140a39a6f08a109e262dcadf5d6acf1e1df06dfd2192
- Size
  
  457KB
- MD5
  
  b8cada23248c735be688419576776c79
- SHA1
  
  560bcac9ae8062b07e6fca1db673b19b7d44c41a
- SHA256
  
  5bb83f0ba00575c13ebd140a39a6f08a109e262dcadf5d6acf1e1df06dfd2192
- SHA512
  
  f167e6b70893ffbe8f4ec77089bee4a2145d3faa9e084a96493ade518e0a2f008faaf1607cced683f2a5d0acfc2851e0e1eebc33b812ec5b2c1a00227e427f6d
- SSDEEP
  
  6144:xH1aphP6ZxqlnU3ijOJj58v9X6/7rYlce7nVElm2Et6pdF:xVanaIlnUBKvF64lVXupdF
Score

10^/10

sectoprat stealc zgrat discovery rat spyware stealer trojan
- Detect ZGRat V1
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2