Extracted

• • Target

    msi (5).msi

  • Size

    33.4MB

  • MD5

    0883973200bb9fc4d641690284d6e052

  • SHA1

    50a1aa74fade4aad8dc76f264a73973d2667b17d

  • SHA256

    4e7243907d83bb073b054ce1eb3508fdd234623b3570c077fa7c0c35ea7e90fc

  • SHA512

    a4cb67d2d51632d29d57df9a89cb0e2e5b6fdaa3931455a8b2b66460da82dde7183b8058f910748057a2c791574e920075d32da4b11c1c71b73e7fc1f290e0d6

  • SSDEEP

    393216:O/u6I9kN75OTLwxaEPnrIzIn/y+NLhxaBJ8oWhKUzLkWEKC+5ylVgTKO/fJ+rFOI:jDEPnelVFLWTUvwrp47

  Score

  10^/10

  sectopratdiscoveryrattrojan

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1