General
- Target https://100worldbeaches.com/n8bhrz.php?xrf=iz12cu6zn2upxbwatzs8&click_id=2074867476927259101&cost=0.01269&sub_source_id=787432_-1&source_id=787432&ip=92.55.204.90&campaign_id=849202&os_type=windows&os_version=10&creative_id=856646&filename=&campaign_name=WL%20787432%205&browser=Opera%20GX
- Sample261008-wdb4ya1vez
Score
10/10
Malware Config
Targets
-
- Target https://100worldbeaches.com/n8bhrz.php?xrf=iz12cu6zn2upxbwatzs8&click_id=2074867476927259101&cost=0.01269&sub_source_id=787432_-1&source_id=787432&ip=92.55.204.90&campaign_id=849202&os_type=windows&os_version=10&creative_id=856646&filename=&campaign_name=WL%20787432%205&browser=Opera%20GX
Score10/10-
Detects SectopRAT aka Arechclient2
-
Family: SectopRAT
SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Executes a VBScript file via the Windows Script Host.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1