Overview

overview

10

Static

static

3

Discord Ni...or.exe

windows7-x64

10

Discord Ni...or.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    255b8e8d638df2dcde755d28b01169a687dcfdc197498dc89c466dd6bb795b34

  • Size

    2.0MB

  • Sample

    241110-hyk1pasdnh

  • MD5

    1c12f1a0b555a2c29dcec839d7e49c8f

  • SHA1

    774149448d535d3a18d0cfb7df0cd2c0ea48c4c1

  • SHA256

    255b8e8d638df2dcde755d28b01169a687dcfdc197498dc89c466dd6bb795b34

  • SHA512

    f1a088792cf914ef376b004bfa73f73aab7c5a0ab94d2edff83f401840662fa67d36f3320b8153a59c165f59263838fcc9eed25b58e3749637791d4e4f9f177a

  • SSDEEP

    49152:CzHL3mUTLYkqdcO6M9H6QMSfCe82Z+JfgCtdxb+h:CzHLhIOO6M9aQNCe8AKfgcxb+h

Score
10/10
sectopratdiscoveryrattrojan

Malware Config

Targets

    • Target

      Discord Nitro Generator.exe

    • Size

      2.0MB

    • MD5

      26aade362e76606a6dd64b1783d989eb

    • SHA1

      feefb270d825aa93a0c249db479bc3308f7a4b5f

    • SHA256

      d235cc33d4a1bad720e4de5e3748ffadc760cfb73326767473e2cb86d1afa3d6

    • SHA512

      2fd7b9ad727dce7a689199f0eac2b6eb6873b8a676a531e2732a94c28e3d20dc19b94ad78efa37db7e5a485adbfb1044e65092f97fe57f3ca4d0cd64ae507a14

    • SSDEEP

      49152:EQ+UdDEITs0m3KMtun3fDokUdlzWsYNZXPL0yJTEx+F:BLNVTsPG0k49WPNZXTw8

    Score
    10/10
    sectopratdiscoveryrattrojan

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Sectoprat family

      sectoprat

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks