Behavioral task
behavioral1
Sample
4409d2170aa9989c6a8dd32b617c51a7c3e328b3c86410813c016691b2bd7774.exe
Resource
win7-20240903-en
General
-
Target
57829b16c22b378c7a5c2e928d9c7ebd44e71b1f8edd5bfd6d072334efa7e958.zip
-
Size
155KB
-
MD5
9f15b1a6990b988188b1dbac989eebb1
-
SHA1
7035fae8a115e7cbe0ae8f8c3d502a899fa1fe55
-
SHA256
57829b16c22b378c7a5c2e928d9c7ebd44e71b1f8edd5bfd6d072334efa7e958
-
SHA512
0119b46d01eac6c847036f78dae11d16603dc4ad03c9fba0fd87400d943c7df5e10a91e7dd826fb209b5e433efc4ae9568a31b522a7a522fa688de6a475c6e20
-
SSDEEP
3072:1GTFyRvI98UbqMLwk8kCgSmJ0AV+d7bLeXMt+NmI9A7XskNmjU7y:Y5wv68UeMLwkJNSmJda7bygmmFXgjU7y
Malware Config
Signatures
-
SectopRAT payload 1 IoCs
resource yara_rule static1/unpack001/4409d2170aa9989c6a8dd32b617c51a7c3e328b3c86410813c016691b2bd7774.exe family_sectoprat -
Sectoprat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/4409d2170aa9989c6a8dd32b617c51a7c3e328b3c86410813c016691b2bd7774.exe
Files
-
57829b16c22b378c7a5c2e928d9c7ebd44e71b1f8edd5bfd6d072334efa7e958.zip.zip
Password: infected
-
4409d2170aa9989c6a8dd32b617c51a7c3e328b3c86410813c016691b2bd7774.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 126KB - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ