Overview

overview

10

Static

static

3

hw_update.zip

windows7-x64

hw_update.zip

windows10-2004-x64

Package/Compil32.exe

windows7-x64

10

Package/Compil32.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    hw_update.zip

  • Size

    3.7MB

  • Sample

    250128-xckv5axpg1

  • MD5

    25d0372df2890f5e2c8f861aba619546

  • SHA1

    33e638d7c0ec8013b790f6326f7ccecd9afd7bce

  • SHA256

    115ce6446eddf3422212760d714babecf2bedbc1178c2d0990be1407fedf380f

  • SHA512

    8a982f3873340bf95c3fba8efbc5c9d80a04b042b4daa2f01e247ab28ca645162925e237e71f6f2d57eec73787d09e101f93912bd235065209d240030e9dc7d7

  • SSDEEP

    98304:e2UuIEWPinaJLLmlzNCS9+AwadoOIL4uih:erXqnuCchAS0uih

Score
10/10
sectopratdiscoveryratspywaretrojan

Malware Config

Targets

    • Target

      hw_update.zip

    • Size

      3.7MB

    • MD5

      25d0372df2890f5e2c8f861aba619546

    • SHA1

      33e638d7c0ec8013b790f6326f7ccecd9afd7bce

    • SHA256

      115ce6446eddf3422212760d714babecf2bedbc1178c2d0990be1407fedf380f

    • SHA512

      8a982f3873340bf95c3fba8efbc5c9d80a04b042b4daa2f01e247ab28ca645162925e237e71f6f2d57eec73787d09e101f93912bd235065209d240030e9dc7d7

    • SSDEEP

      98304:e2UuIEWPinaJLLmlzNCS9+AwadoOIL4uih:erXqnuCchAS0uih

    Score
    1/10
    behavioral1behavioral2

    • Target

      Package/Compil32.exe

    • Size

      4.0MB

    • MD5

      20d23b37c54fc1434ff3105a165cdac7

    • SHA1

      9cb3811fb5f2ecacadc831d82e7e850abedc19ae

    • SHA256

      8fa9074cd74cbcedc44b12999dbc5f4e51ea82caa24be18b073686229f1f9db8

    • SHA512

      40eb9cc31a97996237e69d975efc1a3c22297403bef211427752926a331e9913801bacc7236e4a67ce988c110ccbda3dbd3e65bcc185d512cfc951b0e05fb409

    • SSDEEP

      98304:ByzK9w6TfpPaVG5I+Juv5380exR4KuNFL3N:QWViB3Mwx

    Score
    10/10
    sectopratdiscoveryratspywaretrojan

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Sectoprat family

      sectoprat

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks