Overview

overview

10

Static

static

10

7f386e5780...81.exe

windows7-x64

10

7f386e5780...81.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    17502930540.zip

  • Size

    427KB

  • Sample

    240531-wn7nlaga3y

  • MD5

    0770576a4cc71f46369f1c800d9e39f2

  • SHA1

    d045a2b2733f930e91f30f94ed56f59086893dba

  • SHA256

    549ff34af878b82f3b30e53410389420e0fedc14708d408f1ccb561b85660775

  • SHA512

    bc843d433fe816a546d6aab08ca2bb41577f48278c2714f2d152ca7dddee6e428561d226a193cdaf04a89360808384a3582675b9c2cc83fe9e8f3c42e5ead76d

  • SSDEEP

    6144:p+JXlRdQh8eevZTIJ65v27zqqEzdYsvPzd3Bg5vMMfVS2qrXgh1Ieg4Zk78d01wj:s1lBeexcKcsRvPzzgeQVCrYId4ZSi0Ti

Score
10/10
sectopratdiscoveryratspywarestealertrojan

Malware Config

Targets

    • Target

      7f386e57807f0c2d48b0b33f35e6baf50ba5ee8b000bbd7b4bdd454cedc9ae81

    • Size

      768KB

    • MD5

      ad3d3124026a6a9c8017b57bc71ba72c

    • SHA1

      387657e93af3c08e74fe35a2e7c9fc34c8c5b734

    • SHA256

      7f386e57807f0c2d48b0b33f35e6baf50ba5ee8b000bbd7b4bdd454cedc9ae81

    • SHA512

      7d5e1ace6fc184df2ad96dfaddf270f9191b80d67da60296fba17d49d9b2fb3f48a608cc919a43d53c512978722460adcfa7fee2669a6083cefc5888b46f1e6e

    • SSDEEP

      12288:bvsXZv8km0OHcbGbvzWHz0HnquwTy+g0ssFWylkkoAbtEjQwfNqbYS2VbICKMIUb:EfPz0HILg0ssFlSj4nm

    Score
    10/10
    sectopratdiscoveryratspywarestealertrojan

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks