ReportDump.exe loads sdkcra.dll then reads pool.db (shellcode API resolution cha

Arnold Chan@slaz

•updated Sep 25, 2026•0•0•1

Detects potential activity related to the SectopRAT loader by monitoring the execution sequence of 'ReportDump.exe'. The rule identifies the side-loading of a specific DLL ('sdkcra.dll') followed by the process reading a known configuration or database file ('pool.db') within a short time window, which is indicative of the loader's secondary decryption phase.