Overview

overview

10

Static

static

1

rebuilderUI.exe

windows7-x64

10

rebuilderUI.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rebuilderUI.exe

  • Size

    23.5MB

  • Sample

    241125-nw6r9svnav

  • MD5

    a40675ca8d440353611fd6ba578fec1a

  • SHA1

    ede5d2c3bc31f35ce9161bbf40518abb3dd91d51

  • SHA256

    fe40afb158e24c1896776fe3bdef33d2bb85ae67cf7b115f309d2535fc2a6afd

  • SHA512

    2a874d280966ab80ff864db89abf42f7d1fc5a7caefe3a66eb747f36c8155724d72fd0e4a289313950492cd16c62104d37831462b6b8fcd35621961285c3667f

  • SSDEEP

    393216:KnV+F7Z799sXdJdcKq5wCvSmFR1szWjpE2y7PMo+LXY8s:KnUr77sXBq9b1szWd1y7koV8s

Score
10/10
sectopratdiscoveryratspywaretrojan

Malware Config

Targets

    • Target

      rebuilderUI.exe

    • Size

      23.5MB

    • MD5

      a40675ca8d440353611fd6ba578fec1a

    • SHA1

      ede5d2c3bc31f35ce9161bbf40518abb3dd91d51

    • SHA256

      fe40afb158e24c1896776fe3bdef33d2bb85ae67cf7b115f309d2535fc2a6afd

    • SHA512

      2a874d280966ab80ff864db89abf42f7d1fc5a7caefe3a66eb747f36c8155724d72fd0e4a289313950492cd16c62104d37831462b6b8fcd35621961285c3667f

    • SSDEEP

      393216:KnV+F7Z799sXdJdcKq5wCvSmFR1szWjpE2y7PMo+LXY8s:KnUr77sXBq9b1szWd1y7koV8s

    Score
    10/10
    sectopratdiscoveryratspywaretrojan

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Sectoprat family

      sectoprat

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks