General
-
Target
220815-xemgqshcc9_pw_infected.zip
-
Size
44KB
-
Sample
220904-1nep2aggd3
-
MD5
abbacb0337893cda8dadc6517ce4602c
-
SHA1
0d2538112c5732e0757cf4c034378913d54832c4
-
SHA256
76a23c2c0f53fd0360b8eb6b6204a46f011a59a4b9e66adc1507da50f8a45c38
-
SHA512
42c91eab9a3adc52f88ccf018e3849ce791c47e076b79944018c6e4371f67cd336e44cef9f7457080db0bdb6c58935961778216d3b19c6d2c628684039024704
-
SSDEEP
768:bmr8e4OR3dImEcuW3Mic+eZgTgBRaVTcguNSf6eiO/+MkG1Z/VpgdRZ:Y8eR3dj3Micz2gDatuo/+MXffgDZ
Behavioral task
behavioral1
Sample
8573d9e75f2c0ef4e69023fc07bee9cb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8573d9e75f2c0ef4e69023fc07bee9cb.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
arrowrat
TY
91.134.207.23:5337
DFDFrcvff45thfgh4t44gjahdfhhhhca
Extracted
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{4e498bc7-105a-4838-9874-dcd808cf5910}\0.0.filtertrie.intermediate.txt
Targets
-
-
Target
8573d9e75f2c0ef4e69023fc07bee9cb.exe
-
Size
91KB
-
MD5
8573d9e75f2c0ef4e69023fc07bee9cb
-
SHA1
4f3afbab31505056fd71f462bd52f98f3dd9f8ff
-
SHA256
e5d590f782337416fe7f93aa7f488419f86802500d05ef2fced4ccca7f4e14ae
-
SHA512
11bbaa8c41989d583ca1af59d8c51b80825634807dfcd8fc50f5e8d3190d224ca48139f70e10a2993b9ae1bca599ee0dd1422af5c716f5441c533c1dedef72e7
-
SSDEEP
1536:dbRiQM/57SK3bUzZdQ1iIMvnZlbLxjV3AGq5gWlocT1wzySsd9NJ33B:dbRE57SKsstcnZTJQDgWPaySsdH5x
Score10/10-
Modifies Installed Components in the registry
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext
-