General
- Target https://hurghadatravelguide.com/n8bhrz.php?xrf=iz12cu6zn2upxbwatzs8&click_id=3842429890203328668&cost=0.0028&sub_source_id=1728256_-1&source_id=1728256&ip=5.31.195.39&campaign_id=860781&os_type=windows&os_version=19&creative_id=868421&filename=&campaign_name=WL%201728256&browser=Chrome
- Sample261102-npvfnasyf1
Score
10/10
Malware Config
Targets
-
- Target https://hurghadatravelguide.com/n8bhrz.php?xrf=iz12cu6zn2upxbwatzs8&click_id=3842429890203328668&cost=0.0028&sub_source_id=1728256_-1&source_id=1728256&ip=5.31.195.39&campaign_id=860781&os_type=windows&os_version=19&creative_id=868421&filename=&campaign_name=WL%201728256&browser=Chrome
Score10/10Detects SectopRAT aka Arechclient2
Family: SectopRAT
SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
Executes dropped EXE
Loads dropped DLL
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.