General
- Target setup.exe
- Size 22.6MB
- Sample260723-h5b2csfp5x
- SHA256 86471a7fea86de0cd8301ab2e5220170e154f71a14ce04b15ba67d1ab62a0b7c
Score
10/10
Malware Config
Targets
-
- Target setup.exe
- Size 22.6MB
- SHA256 86471a7fea86de0cd8301ab2e5220170e154f71a14ce04b15ba67d1ab62a0b7c
Score10/10Detects AnimateClipper
Family: AnimateClipper
AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.
Family: SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
SectopRAT payload
Suspicious use of NtCreateUserProcessOtherParentProcess
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3