Overview

overview

10

Static

static

10

287078bd3a...a0.exe

windows7-x64

10

287078bd3a...a0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    287078bd3a14071e64ae1e5b5cadef03cbd0f05bcf2b00d4fdedde5e5d6b95a0.exe

  • Size

    768KB

  • Sample

    240525-bg3e3shb2x

  • MD5

    69c8dfc8afbfb63f2d37e0e71bc9f6f7

  • SHA1

    6a0f4cb9c0c68a0abb639b81cb37025097db76db

  • SHA256

    287078bd3a14071e64ae1e5b5cadef03cbd0f05bcf2b00d4fdedde5e5d6b95a0

  • SHA512

    e87d5150f968d4de4970d43e0fbd426c223e95d99c9278854ebbc0c12a0a2836006d0d9330f3914d654568b2ebfa4a1f454586d02ce79d1f95601a9dc198ea37

  • SSDEEP

    12288:GvsXZv8km0OHcbGbvzWHz0Hnquw3y+20ssFWylkkoAbtEYWwfNqbYS2VbICKMIUz:hfPz0H0L20ssFlSjfoCo

Score
10/10
sectopratdiscoveryratspywarestealertrojan

Malware Config

Targets

    • Target

      287078bd3a14071e64ae1e5b5cadef03cbd0f05bcf2b00d4fdedde5e5d6b95a0.exe

    • Size

      768KB

    • MD5

      69c8dfc8afbfb63f2d37e0e71bc9f6f7

    • SHA1

      6a0f4cb9c0c68a0abb639b81cb37025097db76db

    • SHA256

      287078bd3a14071e64ae1e5b5cadef03cbd0f05bcf2b00d4fdedde5e5d6b95a0

    • SHA512

      e87d5150f968d4de4970d43e0fbd426c223e95d99c9278854ebbc0c12a0a2836006d0d9330f3914d654568b2ebfa4a1f454586d02ce79d1f95601a9dc198ea37

    • SSDEEP

      12288:GvsXZv8km0OHcbGbvzWHz0Hnquw3y+20ssFWylkkoAbtEYWwfNqbYS2VbICKMIUz:hfPz0H0L20ssFlSjfoCo

    Score
    10/10
    sectopratdiscoveryratspywarestealertrojan

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks