Overview

overview

10

Static

static

1

Zoom_v_2.00.4.exe

windows7-x64

7

Zoom_v_2.00.4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Zoom_v_2.00.4.exe

  • Size

    98.4MB

  • Sample

    240515-1r69fseb94

  • MD5

    c0230d748e61819d9dfad0da03fe6ec8

  • SHA1

    951154980d3ddd4101b8e09b11669cbedc86f979

  • SHA256

    3967b38f763b2e58b0679bc0178247b855c68d761187c71c2f1760b6882e473a

  • SHA512

    8ec3af6f3ebf50b5d8ae23e61f442837313b90531e395d8de59ef2aadb49d8200866a069292d6c3d1221416d7cf226ae8628119b468fb6b47687d0b2d1ab4afa

  • SSDEEP

    3145728:0GeG/0W1Wp44zcEyJaETaCV7EulyhkYMndp:R1X1WpBDxC77jlvdb

Score
10/10
sectopratdiscoveryevasionexecutionrattrojan

Malware Config

Targets

    • Target

      Zoom_v_2.00.4.exe

    • Size

      98.4MB

    • MD5

      c0230d748e61819d9dfad0da03fe6ec8

    • SHA1

      951154980d3ddd4101b8e09b11669cbedc86f979

    • SHA256

      3967b38f763b2e58b0679bc0178247b855c68d761187c71c2f1760b6882e473a

    • SHA512

      8ec3af6f3ebf50b5d8ae23e61f442837313b90531e395d8de59ef2aadb49d8200866a069292d6c3d1221416d7cf226ae8628119b468fb6b47687d0b2d1ab4afa

    • SSDEEP

      3145728:0GeG/0W1Wp44zcEyJaETaCV7EulyhkYMndp:R1X1WpBDxC77jlvdb

    Score
    10/10
    sectopratdiscoveryevasionexecutionrattrojan

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks