Overview

overview

10

Static

static

7

17a5152158...ed.exe

windows7-x64

10

17a5152158...ed.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    17a515215854e5660c2b0134ee5fd9ed.bin

  • Size

    2.8MB

  • Sample

    240629-b71n6s1eqn

  • MD5

    17a515215854e5660c2b0134ee5fd9ed

  • SHA1

    82f4b6c2ec7a1d10156002bfa852c0544dd47826

  • SHA256

    6edfd7f60430dd11009b85575bc654a61c5509043b392ef223844417208d0b47

  • SHA512

    b4c035777f3a39d8f73cbfefba3f42032e7b42e3a031e9a2752363e92a0714d2b0d207102ab743b18e9cce24bc33cdf95e6a06b8f6429cba90f15e58ff85911b

  • SSDEEP

    49152:n0CFuwMZamNgmf2P69g5X8iaLsNavw3XsuLcAqdtBfH:0vw9E8Xha+K4cuLcNdtR

Score
10/10
sectopratevasionratthemidatrojan

Malware Config

Targets

    • Target

      17a515215854e5660c2b0134ee5fd9ed.bin

    • Size

      2.8MB

    • MD5

      17a515215854e5660c2b0134ee5fd9ed

    • SHA1

      82f4b6c2ec7a1d10156002bfa852c0544dd47826

    • SHA256

      6edfd7f60430dd11009b85575bc654a61c5509043b392ef223844417208d0b47

    • SHA512

      b4c035777f3a39d8f73cbfefba3f42032e7b42e3a031e9a2752363e92a0714d2b0d207102ab743b18e9cce24bc33cdf95e6a06b8f6429cba90f15e58ff85911b

    • SSDEEP

      49152:n0CFuwMZamNgmf2P69g5X8iaLsNavw3XsuLcAqdtBfH:0vw9E8Xha+K4cuLcNdtR

    Score
    10/10
    sectopratevasionratthemidatrojan

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks