General
- Target 9405a1322f2ba6b5353621a54255aae77c37aca3aa25f93bdcd313f8e3716ca0
- Size 9.6MB
- Sample260428-e6vnbadv51
- SHA256 9405a1322f2ba6b5353621a54255aae77c37aca3aa25f93bdcd313f8e3716ca0
Score
10/10
Malware Config
Targets
-
- Target Business Details.exe
- Size 3.3MB
- SHA256 5d75735ab852877729a360982e1bbf5e8e29c6cc094c9bba4dc628b0f287bf87
Score10/10-
Family: SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target Design.exe
- Size 3.3MB
- SHA256 ec181790ee28b2e443fea1929622fa22a19b061aaa43f888e536831fa848c2fc
Score10/10-
Family: SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target Invoice.exe
- Size 3.1MB
- SHA256 94e8fec242fcc69895cc0183e95834e837ef4da5fd9790a4bbefd0a2787af901
Score10/10-
Family: SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger