Overview

overview

10

Static

static

1

60.msi

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    60.taf

  • Size

    4.7MB

  • Sample

    250402-ymgf5aswct

  • MD5

    ecdd7739e76adee32b9cd61f4a132963

  • SHA1

    14e5ec6b9c6bdaab641009284e2f41067462bf21

  • SHA256

    59baa105734ae018e88a3abeee22657b083d2aaddf1c73e5564bf21382e5fa16

  • SHA512

    91526118167315f2258c1d4e7f2b1d68f8cd7865b8bedafdb1864a4d2084ba8312124aefacc9402a38dd47474e9aabe7ce988c18bfdef9ced275920bf376c229

  • SSDEEP

    98304:5Yqd1ASubUZwPEDYPo6sAPGJ60TGEtof1SvfRL8YwlYfRa6:LHr0PdsAPGJVTGEOdSvfSUa

Score
10/10
sectopratcredential_accessdiscoverypersistenceprivilege_escalationratspywarestealertrojan

Malware Config

Targets

    • Target

      60.taf

    • Size

      4.7MB

    • MD5

      ecdd7739e76adee32b9cd61f4a132963

    • SHA1

      14e5ec6b9c6bdaab641009284e2f41067462bf21

    • SHA256

      59baa105734ae018e88a3abeee22657b083d2aaddf1c73e5564bf21382e5fa16

    • SHA512

      91526118167315f2258c1d4e7f2b1d68f8cd7865b8bedafdb1864a4d2084ba8312124aefacc9402a38dd47474e9aabe7ce988c18bfdef9ced275920bf376c229

    • SSDEEP

      98304:5Yqd1ASubUZwPEDYPo6sAPGJ60TGEtof1SvfRL8YwlYfRa6:LHr0PdsAPGJVTGEOdSvfSUa

    Score
    10/10
    sectopratcredential_accessdiscoverypersistenceprivilege_escalationratspywarestealertrojan

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Sectoprat family

      sectoprat

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks for any installed AV software in registry

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Installer Packages

1
T1546.016

Modify Authentication Process

1
T1556

Privilege Escalation

Event Triggered Execution

1
T1546

Installer Packages

1
T1546.016

Defense Evasion

Modify Authentication Process

1
T1556

System Binary Proxy Execution

1
T1218

Msiexec

1
T1218.007

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Modify Authentication Process

1
T1556

Steal Web Session Cookie

1
T1539

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

2
T1120

Query Registry

4
T1012

Software Discovery

1
T1518

Security Software Discovery

1
T1518.001

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.