Extracted

• • Target

    msi (7).msi

  • Size

    19.9MB

  • MD5

    8496849eda82ac31b355892b6fd86221

  • SHA1

    bb797b7c49cf6e160affd6e7465251cfc0143ba7

  • SHA256

    58c7a3273fa1b84cf28226f8b868af3d1a4447ee2e4f0c3dcf4a315061c23b08

  • SHA512

    ea8606a112667d4f4847505418f5db1ab5d10889ea8bd2935f90d9886810eaaf8d33747331ec002c3400b6dfc23e1208a08a3332738866e661c7bd79d6b66701

  • SSDEEP

    196608:Eh8QnkCrkuKLCBAIk9a7911FuyuON7NKmiRT5kokS6A4d2mOrGIIX5:jYkC4uK2BP9ZuyuOxNzOko14mGlX5

  Score

  10^/10

  sectopratdiscoveryrattrojan

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1