General
-
Target
babc536d2015b19e0944f5c61778c0e6c7c8643720123914dd4cc97ae2e6e7d9N.exe
-
Size
3.4MB
-
Sample
250103-x7mm7sslfr
-
MD5
e81e5f0016aae2d4f9b2ed1126a24030
-
SHA1
369b87b75020cd152b97427c85e8c8a89fe0c1e9
-
SHA256
babc536d2015b19e0944f5c61778c0e6c7c8643720123914dd4cc97ae2e6e7d9
-
SHA512
88c0d4c677e5e3b94b159933e7e60aa87c064ba6df98450265a4b092c07ef75f15297fc7582a1b50ff9bfa9c3a57752ebf19aac41268d60b7efdfcb73f6d2e65
-
SSDEEP
98304:SwRElZ33Li0XUU3FMi9+Q4m1PQKqdiCanFQyRnNlz:ufnGcUU0xm1PsMjXrz
Static task
static1
Behavioral task
behavioral1
Sample
babc536d2015b19e0944f5c61778c0e6c7c8643720123914dd4cc97ae2e6e7d9N.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
babc536d2015b19e0944f5c61778c0e6c7c8643720123914dd4cc97ae2e6e7d9N.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
babc536d2015b19e0944f5c61778c0e6c7c8643720123914dd4cc97ae2e6e7d9N.exe
-
Size
3.4MB
-
MD5
e81e5f0016aae2d4f9b2ed1126a24030
-
SHA1
369b87b75020cd152b97427c85e8c8a89fe0c1e9
-
SHA256
babc536d2015b19e0944f5c61778c0e6c7c8643720123914dd4cc97ae2e6e7d9
-
SHA512
88c0d4c677e5e3b94b159933e7e60aa87c064ba6df98450265a4b092c07ef75f15297fc7582a1b50ff9bfa9c3a57752ebf19aac41268d60b7efdfcb73f6d2e65
-
SSDEEP
98304:SwRElZ33Li0XUU3FMi9+Q4m1PQKqdiCanFQyRnNlz:ufnGcUU0xm1PsMjXrz
Score10/10-
SectopRAT payload
-
Sectoprat family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Enumerates processes with tasklist
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1