General

  • Target

    https://regular-update-your-software.org/beautiful/berry

  • Sample

    250129-t9ehtstjb1

Malware Config

Targets

    • Target

      https://regular-update-your-software.org/beautiful/berry

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Sectoprat family

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks