General
- Target port80.msi
- Size 5.0MB
- Sample261114-ej1wtact9z
- SHA256 414c9037dce4594441fcf9e835ed11520ec9b6d434718913351ef6d6ba1f547e
Malware Config
Targets
-
- Target port80.msi
- Size 5.0MB
- SHA256 414c9037dce4594441fcf9e835ed11520ec9b6d434718913351ef6d6ba1f547e
Score10/10Detects SectopRAT aka Arechclient2
Family: SectopRAT
SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.
Drops a kernel driver into a user folder
Places a kernel driver outside the normal driver folder, which installers may do while staging drivers; malware can do it before loading its own driver to gain kernel-level control.
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
Executes dropped EXE
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Registers new Windows logon scripts automatically executed at logon.
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Installer Packages
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2