General

  • Target

    authenticator.exe

  • Size

    768KB

  • Sample

    240829-qzt9rawfnq

  • MD5

    1560d6506f8e57432427df2bc4263f12

  • SHA1

    70f83580e72e75f4a1b215abf55d9e07beb683f0

  • SHA256

    0bb9e107a5f5f9ad838173ebf222107d37cc1f378fa10f46ad5b2914f19f8e72

  • SHA512

    e5b0eff2054b6b24efeb9f8df23cd22e307d5fac1669e86b798d8caee2e3c4ea3e4c6213abe868ba44b37b689e5b52d4d3a40fd0167a476c06bc32dded69a202

  • SSDEEP

    12288:rvsXZv8km0OHcbGbvzWHz0Hnquw3y+h0ssFWylkkoAbtEkOwfNqbYS2VbICKMIU6:UfPz0H0Lh0ssFlSjbmk

Malware Config

Targets

    • Target

      authenticator.exe

    • Size

      768KB

    • MD5

      1560d6506f8e57432427df2bc4263f12

    • SHA1

      70f83580e72e75f4a1b215abf55d9e07beb683f0

    • SHA256

      0bb9e107a5f5f9ad838173ebf222107d37cc1f378fa10f46ad5b2914f19f8e72

    • SHA512

      e5b0eff2054b6b24efeb9f8df23cd22e307d5fac1669e86b798d8caee2e3c4ea3e4c6213abe868ba44b37b689e5b52d4d3a40fd0167a476c06bc32dded69a202

    • SSDEEP

      12288:rvsXZv8km0OHcbGbvzWHz0Hnquw3y+h0ssFWylkkoAbtEkOwfNqbYS2VbICKMIU6:UfPz0H0Lh0ssFlSjbmk

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks