Extracted

Extracted

• • Target
    Setup.exe
  • Size 94KB
  • SHA256 8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47
  • MD5 eba77a34e9b8aa78fce520d1431fc68b
  • SHA1 215105e2640cd6da8adc1ea9ddafeb08c4d50f9b
  • SHA512 fa66a42dd71fc862c218777b572f143144a7de0c5d8630061a554e6ebb9ad4557d810e7ca75598254231cb41dec2391c49a362206b8275742b5a5b92ee33417f
  • SSDEEP 1536:ZaakYDoIhIxHHWMpdPa5wiE21M8kJIGFvb1Cw3/73sJxy+C:FDpSwMpdCq/IM8uIGfN/73sJTC
  • TLSH
    T1A593D541E62DBDDDE508D4310A75E0F25E24EC3176C0A51EA7F37F0629726A3F90A93A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryacrstealerprivilege_escalationstealerexecutionsectopratpersistenceratspywaretrojan

  • Detects SectopRAT aka Arechclient2

  • Family: ACR stealer,GrMsk

    ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

    stealeracrstealer

  • Family: SectopRAT

    SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4