Overview

overview

10

Static

static

3

7c9de4e346...51.exe

windows7-x64

10

7c9de4e346...51.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7c9de4e346a8efe69569337c623cbde71abf0e9e4e8c83e9a45a20181e0f3951.exe

  • Size

    3.6MB

  • Sample

    250113-wnx46a1rhv

  • MD5

    9324c48eadf64b3c9c3be1724808d47d

  • SHA1

    b6f35cd27e57b39d9f25a86dd980fe44fd7576af

  • SHA256

    7c9de4e346a8efe69569337c623cbde71abf0e9e4e8c83e9a45a20181e0f3951

  • SHA512

    128bafe7067f24794bad68c0d7074e7759848ad50f08d2338c949663f8656d44a66ae5cbc82d942d6e69e3a37b0fdf2c3061b88dd852f1e8524d7401fe247111

  • SSDEEP

    98304:SwRElZ33Li0XUU3FMi9+Q4m1PQKq39swQHZ:ufnGcUU0xm1PsmlZ

Score
10/10
sectopratdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      7c9de4e346a8efe69569337c623cbde71abf0e9e4e8c83e9a45a20181e0f3951.exe

    • Size

      3.6MB

    • MD5

      9324c48eadf64b3c9c3be1724808d47d

    • SHA1

      b6f35cd27e57b39d9f25a86dd980fe44fd7576af

    • SHA256

      7c9de4e346a8efe69569337c623cbde71abf0e9e4e8c83e9a45a20181e0f3951

    • SHA512

      128bafe7067f24794bad68c0d7074e7759848ad50f08d2338c949663f8656d44a66ae5cbc82d942d6e69e3a37b0fdf2c3061b88dd852f1e8524d7401fe247111

    • SSDEEP

      98304:SwRElZ33Li0XUU3FMi9+Q4m1PQKq39swQHZ:ufnGcUU0xm1PsmlZ

    Score
    10/10
    sectopratdiscoverypersistencerattrojan

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Sectoprat family

      sectoprat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Enumerates processes with tasklist

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks