Extracted

Extracted

Extracted

• • Target
    New Text Document.bat
  • Size 153B
  • SHA256 f476ba202ee4a8e1bfcbb6cf5571cad282c445ab1d29a2bddcad8544ca292982
  • MD5 5af5862df269b0e56b98c67efd1583a4
  • SHA1 2fc505d60568a98f3836a57f81d89c25dd6c8f14
  • SHA512 fda0babd4466aa7c20e5b2adced4fbaaa19351bce2f9c5f56c7f1470ff7d927dcf8f99597b3a8167c206af473efaa45ec8b0066781d6b38b9b958dfc02f09e68
  • TLSH
    T100C080591410F5AB194540352515DD0E644308C544B1B0057755DD1B4CA64B95A45517
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  discoveryexecutionhijackloadersectopratloaderpersistenceprivilege_escalationrattrojanransomware

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Family: SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2