Dumps.zip
- SHA256 fd1d0df3eb3137f9c7842c8053c3ec08c3488e093b9b4e8d0108dc7ec40c1048
Behavioral task
behavioral1
Sample
Dumps/MSBuild.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Dumps/MSBuild.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Dumps/WbElevation.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Dumps/WbElevation.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Dumps/ypvjxfwz3ph.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target Dumps.zip
- Size 387KB
- Sample261104-vgkd2ss1bw
- SHA256 fd1d0df3eb3137f9c7842c8053c3ec08c3488e093b9b4e8d0108dc7ec40c1048
- MD5 f95009f8a3fa05db822601b8b922ec36
- SHA1 954ecf45f248ac70e86d9d7c43b5e68f86212ff7
- SHA512 421e350acdfd0f47e492474ce6fef546f1ed27193a7e6d9097d3d7e82c0203e41929fb774a02ec2446376f372fb94ecf9a1370b4b9aa77ea0d12fdbdef147e7a
- SSDEEP 6144:v+Ha0k0U4TTRfIML8L2u2CJgk88Z/tUFC1EEoTmy250GYgFeY4xoPnPxh:2xk0eML8iu2CFxX1oTjMqgFYxy5h
- TLSH T16C8423D858561498E0C9AB7E05BD7C3B210EE3B8F095155B8CB7A24B2CF47FA1C386D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects SectopRAT aka Arechclient2 1 IoCs
resource yara_rule static1/unpack001/Dumps/ypvjxfwz3ph.exe family_sectoprat - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Dumps/MSBuild.exe unpack001/Dumps/WbElevation.dll unpack001/Dumps/ypvjxfwz3ph.exe
File Explorer
-
Dumps.zip.zip 387KB
-
Dumps/MSBuild.exe.exe 236KB
-
Dumps/WbElevation.dll.dll 113KB
-
Dumps/ypvjxfwz3ph.exe.exe 411KB
Dumps/MSBuild.exe
- SHA256 b225ccbb70e5b3d47cf70d9ee0f36eafa3eed58b6b02e11f0cd2c909b9435ba7
- MD5 521cbd5279d4bd0f0b356371150bc478
- SHA1 bef754633c2613796fc1317693d0d127cd7868d5
- SHA512 b7945cbec187cd606ae607c3cd0214644aae263d8af268498912bded29a62bb261822ce9adaaa1f5fecb9b513aa23edb5c52b7e771a8b83e94f41ef92028ced6
- SSDEEP 3072:4DEKKwBWmSEoRoocfZO8gQYiY35ePw2XpFU4rwOe8ZbZEmf02RFitrBP:SHK2W0u1EO80+RXfiQ02biFd
- TLSH T111344A1167ED4625F6FF0AB8B8B015158B76F827E866D75E388C61AC1F73700E9A0363
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\amd64\MSBuild.pdb
Name
.text
Size
223KB
Virtual Size
222KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Dumps/WbElevation.dll
- SHA256 3c7ee535ff25a72644771a5a27a58a0347562e1f35507cce9249ffbee7ebff0d
- MD5 bcda03d8cc7d4578f72b8360bbbbda89
- SHA1 0b3e712c3ef2ff124aa84da315b668078ebf4fa6
- SHA512 0dd39e01f1307bc8e6ef7d80decc3282ecda6bd20af597d936e4242608d82f0d323b9c6e1cd0468d00f5e7c8b4f066a641aa88cfd42c5132916dd42cbb0ea550
- SSDEEP 3072:0y4UhJYtoWyKEQKfC45js2oMV95iy3MTF:1mByKIUSsGO
- TLSH T154B32799BB159176DFEF473484F7290D80F032A94942E23F299DEAD07E946EC431EB80
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
112KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Dumps/ypvjxfwz3ph.exe
- SHA256 afe1de913644654433ea92f4d59f00ece9e0774726555aaeb7e8a6edb8c5ba8d
- MD5 c56b32924d4408886d91312b2c0efbc0
- SHA1 0224be3bcb876d14e7988c34147b7028f31742cf
- SHA512 684b48f4250e182d88dec36cae961e1eb7b16f2c265bf845a743147581957fefdb1d823e68fcee0f81c515b78f2c2c53108a60d9c21bc2c5e41786b59606dd8c
- SSDEEP 6144:dXbFAMNKF3xaJbO4l+Zn0ZF/iWc79FSvG8SB4Zr6FyyPrtL+FjKwWp8XLfXUzbFP:dLbJbO44ZnYWPrBbyyPrtWj9Wp8zX
- TLSH T1B79407AC7747AA35EEE5B73440FF651887B712A2595E653F098898C13F8038ED71CE88
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects SectopRAT aka Arechclient2
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
409KB
Virtual Size
409KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ