sectoprat | 17cc948ce12fa4f3937cd46a3d55ba91ee3888d2639e6e81a02f6668634ae45e | Triage

Submit
Reports

Overview

overview

Static

static

7

ead38e3463...18.exe

windows7-x64

ead38e3463...18.exe

windows10-2004-x64

Sharing

General

Target

ead38e34636b15ccbc4dfee64e6ce092_JaffaCakes118
Size

4.7MB
Sample

241213-lblkgstnf1
MD5

ead38e34636b15ccbc4dfee64e6ce092
SHA1

f4cd85387bf9dd8ff64a8ea54b2217a1c274468d
SHA256

17cc948ce12fa4f3937cd46a3d55ba91ee3888d2639e6e81a02f6668634ae45e
SHA512

483529bbde0bff6f52bee61d41c5350029b1d3f8326eb3a506490565ceec95905066e37acffb1a9d74847d8ffe128542b3bee4a0079163d2f2877464fd7a8953
SSDEEP

98304:yLuRfB6HMaYjE4NG4doFGuLGuS4sGTFO1F6P0Sc5sj7ACg58EZJkbSn:yLuRfwHmjE8WGuPssYkBjBg58Qn

Score

10^/10

sectoprat discovery evasion rat themida trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

ead38e34636b15ccbc4dfee64e6ce092_JaffaCakes118.exe

Resource

win7-20240903-en

sectoprat discovery evasion rat themida trojan

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

ead38e34636b15ccbc4dfee64e6ce092_JaffaCakes118.exe

Resource

win10v2004-20241007-en

sectoprat discovery evasion rat themida trojan

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  ead38e34636b15ccbc4dfee64e6ce092_JaffaCakes118
- Size
  
  4.7MB
- MD5
  
  ead38e34636b15ccbc4dfee64e6ce092
- SHA1
  
  f4cd85387bf9dd8ff64a8ea54b2217a1c274468d
- SHA256
  
  17cc948ce12fa4f3937cd46a3d55ba91ee3888d2639e6e81a02f6668634ae45e
- SHA512
  
  483529bbde0bff6f52bee61d41c5350029b1d3f8326eb3a506490565ceec95905066e37acffb1a9d74847d8ffe128542b3bee4a0079163d2f2877464fd7a8953
- SSDEEP
  
  98304:yLuRfB6HMaYjE4NG4doFGuLGuS4sGTFO1F6P0Sc5sj7ACg58EZJkbSn:yLuRfwHmjE8WGuPssYkBjBg58Qn
Score

10^/10

sectoprat discovery evasion rat themida trojan
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Sectoprat family
  sectoprat
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

sectopratdiscoveryevasionratthemidatrojan

behavioral2

sectopratdiscoveryevasionratthemidatrojan

© 2018-2024

Terms | Privacy