General

  • Target

    babc536d2015b19e0944f5c61778c0e6c7c8643720123914dd4cc97ae2e6e7d9N.exe

  • Size

    3.4MB

  • Sample

    250103-x7mm7sslfr

  • MD5

    e81e5f0016aae2d4f9b2ed1126a24030

  • SHA1

    369b87b75020cd152b97427c85e8c8a89fe0c1e9

  • SHA256

    babc536d2015b19e0944f5c61778c0e6c7c8643720123914dd4cc97ae2e6e7d9

  • SHA512

    88c0d4c677e5e3b94b159933e7e60aa87c064ba6df98450265a4b092c07ef75f15297fc7582a1b50ff9bfa9c3a57752ebf19aac41268d60b7efdfcb73f6d2e65

  • SSDEEP

    98304:SwRElZ33Li0XUU3FMi9+Q4m1PQKqdiCanFQyRnNlz:ufnGcUU0xm1PsMjXrz

Malware Config

Targets

    • Target

      babc536d2015b19e0944f5c61778c0e6c7c8643720123914dd4cc97ae2e6e7d9N.exe

    • Size

      3.4MB

    • MD5

      e81e5f0016aae2d4f9b2ed1126a24030

    • SHA1

      369b87b75020cd152b97427c85e8c8a89fe0c1e9

    • SHA256

      babc536d2015b19e0944f5c61778c0e6c7c8643720123914dd4cc97ae2e6e7d9

    • SHA512

      88c0d4c677e5e3b94b159933e7e60aa87c064ba6df98450265a4b092c07ef75f15297fc7582a1b50ff9bfa9c3a57752ebf19aac41268d60b7efdfcb73f6d2e65

    • SSDEEP

      98304:SwRElZ33Li0XUU3FMi9+Q4m1PQKqdiCanFQyRnNlz:ufnGcUU0xm1PsMjXrz

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Enumerates processes with tasklist

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks