sectoprat

General

Target

bc94d3e144094adfc05a04725116e9b740796a7591c771b62941a06aa6a96129.exe
Size

4.0MB
Sample

241115-vggyxsxjhy
MD5

29a2e4569a2eb8cab1be4d226784827e
SHA1

f79f2f382f3c1764b55aa160ecf6ed84358fb070
SHA256

bc94d3e144094adfc05a04725116e9b740796a7591c771b62941a06aa6a96129
SHA512

e205b3813619504eed8b4ae938fad247cb70e9172a15e32f64316bbc2afe225d7a9e7e3e1925bc9c35659b9f5e8b80012fc02bb24afe3d60fb8ef74a40a2e482
SSDEEP

49152:PjKdrRvp7grhJqZyc0PGMMlADKD7IRHxw:PjKdrRvJchJq6GPlA2D0RHxw

Score

10^/10

Malware Config

Targets

- Target
  
  bc94d3e144094adfc05a04725116e9b740796a7591c771b62941a06aa6a96129.exe
- Size
  
  4.0MB
- MD5
  
  29a2e4569a2eb8cab1be4d226784827e
- SHA1
  
  f79f2f382f3c1764b55aa160ecf6ed84358fb070
- SHA256
  
  bc94d3e144094adfc05a04725116e9b740796a7591c771b62941a06aa6a96129
- SHA512
  
  e205b3813619504eed8b4ae938fad247cb70e9172a15e32f64316bbc2afe225d7a9e7e3e1925bc9c35659b9f5e8b80012fc02bb24afe3d60fb8ef74a40a2e482
- SSDEEP
  
  49152:PjKdrRvp7grhJqZyc0PGMMlADKD7IRHxw:PjKdrRvJchJq6GPlA2D0RHxw
Score

10^/10

sectoprat discovery persistence ransomware rat spyware stealer trojan
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Sectoprat family
  sectoprat
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates processes with tasklist
  discovery
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2