sectoprat | 45ab4ca2483759d89bc446e6797e86489eb08cfeb3f740440a83ff6d83eb5503 | Triage

Sharing

General

Target

45ab4ca2483759d89bc446e6797e86489eb08cfeb3f740440a83ff6d83eb5503.ps1
Size

35KB
Sample

241220-q7yxxaxqbr
MD5

6a34a3dbed524eed6d73c72188418d80
SHA1

6a6ee1aa6ad9d9fbd7b7112df3a5c92b83c18667
SHA256

45ab4ca2483759d89bc446e6797e86489eb08cfeb3f740440a83ff6d83eb5503
SHA512

6fd7dc31836db3062aea0ab2bf0c7b0c45ee188fa9f2a872de968db2635aefc404d057444ec15ffea66585f6aa8e18acf2088e9523ac9138680ef6061465db30
SSDEEP

96:YdgXCdz1ArDw1DQXZB08+uFk0WK49Ms00IYY+blwIAAwIYmEYsR0KkMEIIAAYwwP:EZu

Score

10^/10

sectoprat discovery execution persistence rat trojan

Malware Config

Targets

- Target
  
  45ab4ca2483759d89bc446e6797e86489eb08cfeb3f740440a83ff6d83eb5503.ps1
- Size
  
  35KB
- MD5
  
  6a34a3dbed524eed6d73c72188418d80
- SHA1
  
  6a6ee1aa6ad9d9fbd7b7112df3a5c92b83c18667
- SHA256
  
  45ab4ca2483759d89bc446e6797e86489eb08cfeb3f740440a83ff6d83eb5503
- SHA512
  
  6fd7dc31836db3062aea0ab2bf0c7b0c45ee188fa9f2a872de968db2635aefc404d057444ec15ffea66585f6aa8e18acf2088e9523ac9138680ef6061465db30
- SSDEEP
  
  96:YdgXCdz1ArDw1DQXZB08+uFk0WK49Ms00IYY+blwIAAwIYmEYsR0KkMEIIAAYwwP:EZu
Score

10^/10

execution sectoprat discovery persistence rat trojan
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Sectoprat family
  sectoprat
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

sectopratdiscoveryexecutionpersistencerattrojan