Overview

overview

10

Static

static

1

afbdaa974c...07.msi

windows7-x64

10

afbdaa974c...07.msi

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    afbdaa974cdc9624fe94b5c0ca6ce01695570790a68cc9c86ea0619973f13d07.msi

  • Size

    2.9MB

  • Sample

    241018-l43pgatdnn

  • MD5

    d87cc5fb2d4047d442446cc6d2d01cf9

  • SHA1

    8d2c76bb8248b1c8171c4cc198255d5613afe6fe

  • SHA256

    afbdaa974cdc9624fe94b5c0ca6ce01695570790a68cc9c86ea0619973f13d07

  • SHA512

    542e85c82bb770f8e4c6415597330d541be2a21c1e95f83c9e57db5df123255be831f4beab56f7211dd1b7c3823838ce3526fa16ae81f5d9bf4767ab46217333

  • SSDEEP

    49152:NiSoOl+YyNuCClJkqr6zeM4I/157fW8KvSu784p0mKZ+nYxgrFUhmnb+t1cVDUqb:Nt7+YJCCvkP4Id59Kvv8KGZgYyyuqtUF

Score
10/10
sectopratdiscoverypersistenceprivilege_escalationrattrojan

Malware Config

Targets

    • Target

      afbdaa974cdc9624fe94b5c0ca6ce01695570790a68cc9c86ea0619973f13d07.msi

    • Size

      2.9MB

    • MD5

      d87cc5fb2d4047d442446cc6d2d01cf9

    • SHA1

      8d2c76bb8248b1c8171c4cc198255d5613afe6fe

    • SHA256

      afbdaa974cdc9624fe94b5c0ca6ce01695570790a68cc9c86ea0619973f13d07

    • SHA512

      542e85c82bb770f8e4c6415597330d541be2a21c1e95f83c9e57db5df123255be831f4beab56f7211dd1b7c3823838ce3526fa16ae81f5d9bf4767ab46217333

    • SSDEEP

      49152:NiSoOl+YyNuCClJkqr6zeM4I/157fW8KvSu784p0mKZ+nYxgrFUhmnb+t1cVDUqb:Nt7+YJCCvkP4Id59Kvv8KGZgYyyuqtUF

    Score
    10/10
    sectopratdiscoverypersistenceprivilege_escalationrattrojan

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks