Threat video1:00
SectopRAT GPULoader and VMLoader: Detection & IOCs
VMLoader and GPULoader deliver SectopRAT via fake installers and GPU-based decryption. Detect it with 9 detection rules, 32 IOCs and a free Splunk SPL rule.
Read the full threat intel for SectopRAT GPULoader and VMLoader: Detection & IOCs →
Chapters
- 0:00The hookFake installers deliver a stealer.
- 0:04The storyThe campaign has been active since April.
- 0:10Attack pathExaTrack: fake installers via malvertising.
- 0:24AttributionNo threat actor is attributed.
- 0:29Indicators of compromise29 indicators to hunt: 11 IPs, 7 domains and 9 SHA-256 hashes, and more.
- 0:38MITRE ATT&CK techniques21 ATT&CK techniques, from resource development to impact.
- 0:43Remediation5 steps now: Block the VMLoader staging domains, the FakeGuard C2 IPs.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Fake installers deliver a stealer.
0:05The campaign has been active since April.
0:10ExaTrack: fake installers via malvertising.
0:14VMLoader checks the GPU first.
0:16Modules decrypt, then GPU decrypts a file.
0:20FakeGuard: a banking AitM tool.
0:25No threat actor is attributed. Confidence: low.
0:2929 indicators to hunt: 11 IPs, 7 domains and 9 SHA-256 hashes, and more.
0:3921 ATT&CK techniques, from resource development to impact.
0:445 steps now: Block the VMLoader staging domains, the FakeGuard C2 IPs.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.