Overview

overview

10

Static

static

10

Dumps/MSBuild.exe

windows10-2004-x64

1

Dumps/MSBuild.exe

windows11-ltsc_2024-x64

1

Dumps/WbElevation.dll

windows10-2004-x64

1

Dumps/WbElevation.dll

windows11-ltsc_2024-x64

1

Dumps/ypvjxfwz3ph.exe

windows10-2004-x64

10

Dumps/ypvjxfwz3ph.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Dumps.zip
  • Size 387KB
  • Sample261104-vgkd2ss1bw
  • SHA256 fd1d0df3eb3137f9c7842c8053c3ec08c3488e093b9b4e8d0108dc7ec40c1048
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
sectopratrattrojan

Malware Config

Targets

    • Target
      Dumps/MSBuild.exe
    • Size 236KB
    • SHA256 b225ccbb70e5b3d47cf70d9ee0f36eafa3eed58b6b02e11f0cd2c909b9435ba7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      Dumps/WbElevation.dll
    • Size 113KB
    • SHA256 3c7ee535ff25a72644771a5a27a58a0347562e1f35507cce9249ffbee7ebff0d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      Dumps/ypvjxfwz3ph.exe
    • Size 411KB
    • SHA256 afe1de913644654433ea92f4d59f00ece9e0774726555aaeb7e8a6edb8c5ba8d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    sectopratrattrojan

    • Detects SectopRAT aka Arechclient2

    • Family: SectopRAT

      SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.

      trojanratsectoprat
    behavioral5behavioral6

MITRE ATT&CK Matrix

Tasks