arrowrat | Stub[.]exe

General

Target
Stub.exe
Size 155KB
Sample221010-t3ng6acef4
SHA256 fb48bb91678c696679b72b046aa24ecddb98c4ccf65d068393cdb722cdba8caa
MD5 27055f0656283c1bcdafec2beeee39d5
SHA1 06947c8acfcc7fa067e761ba76d2ef250fba97ad
SHA512 0ae5ed68882e75ed59ecf0cccd3cfaf7ae40add418416bdc5659b02bac33c872884ccd63d6be7912ba976af6e8ae4e5ee09937afcf8b23d8675b40f8ff7447cc
SSDEEP 3072:zbRH2+0nmBELlEGXsy1UvVeB04aIcwIlq3Ttmbo868Y:zbRL0nNJn8y+VeBO9l0TtmboT8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

client arrowrat

Malware Config

Extracted

Family

arrowrat

Botnet

Client

C2

pdra.duckdns.org:5788

Mutex

VtREmXzYA

Signatures

Arrowrat family
arrowrat

File Explorer

Stub.exe

.exe 155KB

Stub.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 fb48bb91678c696679b72b046aa24ecddb98c4ccf65d068393cdb722cdba8caa
MD5 27055f0656283c1bcdafec2beeee39d5
SHA1 06947c8acfcc7fa067e761ba76d2ef250fba97ad
SHA512 0ae5ed68882e75ed59ecf0cccd3cfaf7ae40add418416bdc5659b02bac33c872884ccd63d6be7912ba976af6e8ae4e5ee09937afcf8b23d8675b40f8ff7447cc
SSDEEP 3072:zbRH2+0nmBELlEGXsy1UvVeB04aIcwIlq3Ttmbo868Y:zbRL0nNJn8y+VeBO9l0TtmboT8
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

161502

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing