sectoprat

General

Target

068ff5d3afc237d06e1b0fb43294823fc34e89860c6706019be2e4e7fcf10a31
Size

451KB
Sample

240428-rk974ahe36
MD5

c6edc5e4d08d8edbca56cfd65579a9f0
SHA1

8c36103bcaef99fa73a7bfec2b170a06dd75de12
SHA256

068ff5d3afc237d06e1b0fb43294823fc34e89860c6706019be2e4e7fcf10a31
SHA512

ece0229fb2213d67f3d35f53155392f2b4fbf8614f58bbb44fa7bd8191d166b4ee58f0917286b560f6b78b9c9d729f28b523d8dbc042416deb4c053262adcd5a
SSDEEP

6144:+0HYlMeYOX8mE94DowCxV0jZVqmnvi1UVX1Zbt2S0gjaUN:+04lMXmQ4LCxWjZji1U/rhaUN

Score

10^/10

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes

url_path
/c698e1bc8a2f5e6d.php

Targets

- Target
  
  068ff5d3afc237d06e1b0fb43294823fc34e89860c6706019be2e4e7fcf10a31
- Size
  
  451KB
- MD5
  
  c6edc5e4d08d8edbca56cfd65579a9f0
- SHA1
  
  8c36103bcaef99fa73a7bfec2b170a06dd75de12
- SHA256
  
  068ff5d3afc237d06e1b0fb43294823fc34e89860c6706019be2e4e7fcf10a31
- SHA512
  
  ece0229fb2213d67f3d35f53155392f2b4fbf8614f58bbb44fa7bd8191d166b4ee58f0917286b560f6b78b9c9d729f28b523d8dbc042416deb4c053262adcd5a
- SSDEEP
  
  6144:+0HYlMeYOX8mE94DowCxV0jZVqmnvi1UVX1Zbt2S0gjaUN:+04lMXmQ4LCxWjZji1U/rhaUN
Score

10^/10

sectoprat stealc zgrat discovery rat spyware stealer trojan
- Detect ZGRat V1
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2