Overview

overview

10

Static

static

10

400000.MSBuild.exe

windows7-x64

10

400000.MSBuild.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    400000.MSBuild.exe

  • Size

    768KB

  • Sample

    241105-2tywjazkft

  • MD5

    8647da6123bbe1989f8d3ea6599acab6

  • SHA1

    1aff68b219b09d9b915b2d376d5a91cd84b8e4ae

  • SHA256

    ec32b35a3a73dc1951eb9e6d148b7273346d560b8015c8dbc5028709e62bc74c

  • SHA512

    58f823a4fc7c66542e7235eea7be16bcde045817d5e860403707809756825bd26df89bcae2609abc427cb9e7e17b8570b4b0c55f4cc116ed57928db64bb0cbef

  • SSDEEP

    12288:cvsXZv8km0OHcbGbvzWHz0HnquwO4+j0ssFWylkkoAbtEhHwfNqbYS2VbICKMIU9:nfPz0HFxj0ssFlSjZhq

Score
10/10
sectopratdiscoveryratspywarestealertrojan

Malware Config

Targets

    • Target

      400000.MSBuild.exe

    • Size

      768KB

    • MD5

      8647da6123bbe1989f8d3ea6599acab6

    • SHA1

      1aff68b219b09d9b915b2d376d5a91cd84b8e4ae

    • SHA256

      ec32b35a3a73dc1951eb9e6d148b7273346d560b8015c8dbc5028709e62bc74c

    • SHA512

      58f823a4fc7c66542e7235eea7be16bcde045817d5e860403707809756825bd26df89bcae2609abc427cb9e7e17b8570b4b0c55f4cc116ed57928db64bb0cbef

    • SSDEEP

      12288:cvsXZv8km0OHcbGbvzWHz0HnquwO4+j0ssFWylkkoAbtEhHwfNqbYS2VbICKMIU9:nfPz0HFxj0ssFlSjZhq

    Score
    10/10
    sectopratdiscoveryratspywarestealertrojan

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Sectoprat family

      sectoprat

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks