Overview

overview

10

Static

static

3

d86774d511...97.exe

windows7-x64

10

d86774d511...97.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d86774d511b6bfcda26a33eb116381a2069943d6f4519fb200848f4c798db297

  • Size

    6.5MB

  • Sample

    240716-zl1daazanl

  • MD5

    d73d3a05eb81db4bfbaabd856e4bf3bd

  • SHA1

    8c8b767a8c764e6a28ce1e103868ff1b0352a92c

  • SHA256

    d86774d511b6bfcda26a33eb116381a2069943d6f4519fb200848f4c798db297

  • SHA512

    0229ba415fd90bdcbff612779c6edef9a10c580dd0b684c529d3cdaf87096bd6522c94be4a2719900bdc028916ea9ed87d6e560a0ed4c9fabf432f21e8f8cc6e

  • SSDEEP

    98304:+/KaPjsr/EC+VfUyHEA+R1bByG+H1iV9RLafmbByG+H1iV9YbByG+H1iV9JT4o+k:0jsr/E/Vdy19k1iN39k1iU9k1iNfqOh

Score
10/10
sectopratdiscoverypersistenceratspywarestealertrojan

Malware Config

Targets

    • Target

      d86774d511b6bfcda26a33eb116381a2069943d6f4519fb200848f4c798db297

    • Size

      6.5MB

    • MD5

      d73d3a05eb81db4bfbaabd856e4bf3bd

    • SHA1

      8c8b767a8c764e6a28ce1e103868ff1b0352a92c

    • SHA256

      d86774d511b6bfcda26a33eb116381a2069943d6f4519fb200848f4c798db297

    • SHA512

      0229ba415fd90bdcbff612779c6edef9a10c580dd0b684c529d3cdaf87096bd6522c94be4a2719900bdc028916ea9ed87d6e560a0ed4c9fabf432f21e8f8cc6e

    • SSDEEP

      98304:+/KaPjsr/EC+VfUyHEA+R1bByG+H1iV9RLafmbByG+H1iV9YbByG+H1iV9JT4o+k:0jsr/E/Vdy19k1iN39k1iU9k1iNfqOh

    Score
    10/10
    sectopratdiscoverypersistenceratspywarestealertrojan

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks