Behavioral task
behavioral1
Sample
c7d0b390567d5933ed58208304b94d13.exe
Resource
win7-20240221-en
General
-
Target
c7d0b390567d5933ed58208304b94d13
-
Size
9.2MB
-
MD5
c7d0b390567d5933ed58208304b94d13
-
SHA1
d4586ca005967c94494f2ec909062e8fd8ab5272
-
SHA256
93425d0802769561d1a8f5e81ff7825879486085b1a4e95c28513f0cf17131a1
-
SHA512
1a0783520f891f82fa44646a90e364cae3331db3343f69ce61e956313abbe00bec94757fe580e667e541ca0c0304b9da3c5374b1b22270ea415b471542aa65e1
-
SSDEEP
98304:/R+6n9kgmGiat5uXiP+iW3O2KXEAbAhLwO/1w4sDVdBu2z:bViAg4lqO2D5+VVvb
Malware Config
Signatures
-
SectopRAT payload 1 IoCs
resource yara_rule sample family_sectoprat -
Sectoprat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c7d0b390567d5933ed58208304b94d13
Files
-
c7d0b390567d5933ed58208304b94d13.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ