Behavioral task
behavioral1
Sample
tmpyv85o_68.exe
Resource
win7-20240708-en
General
-
Target
tmpyv85o_68
-
Size
768KB
-
MD5
fe96d6f96b4ce1178c478216afc11f31
-
SHA1
d5dc8e1982695015e90254534f16d2b3663d120c
-
SHA256
7808f3aea222cdbec2e53b126f46195f4523e9501882b94e0cd42e30f8484f32
-
SHA512
da8ec729601722a62fde92680f276d8b7a68217437769c738908026fa58be7b5b897c910b4bd0198c941437116f5befe160677b90e86feb4f2e231d4939b923b
-
SSDEEP
12288:zvsXZv8km0OHcbGbvzWHz0HnquwTl+U0ssFWylkkoAbtEJKwfNqbYS2VbICKMIUe:MfPz0HI0U0ssFlSj0hl
Malware Config
Signatures
-
SectopRAT payload 1 IoCs
resource yara_rule sample family_sectoprat -
Sectoprat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource tmpyv85o_68
Files
-
tmpyv85o_68.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 766KB - Virtual size: 765KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ