arrowrat | 2324-140-0x0000000000400000-0x000000000042C000-memory[.]dmp

General

Target
2324-140-0x0000000000400000-0x000000000042C000-memory.dmp
Size 176KB
Sample221127-w72xfsdf2y
SHA256 4e4dcd976d91fa65cc102b3a9a067852c0bfe2c080d46917d311ff46187cfa28
MD5 be9bb3085ed5cd7c5e3212addfafabde
SHA1 bb0080502f256430ad450b45a25c1effdb60b953
SHA512 dbf724492c5eecd4b3ef79039ff6cf0f11fa282904d489ef7ed51cddeceb9bf9320f59a19fb76c689d0d175127236f040e70b38c0815d6adb6396b5d7d685386
SSDEEP 3072:ebRH+0O5VbFHexuiCrK0ovzNC0Fie+5cVjvn+sZCh8/QbM768Y:ebRe0OLoxuiCNovpke+cvnOaQJ8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

client arrowrat

Malware Config

Extracted

Family

arrowrat

Botnet

Client

C2

65.108.204.97:1337

Mutex

PreIzXewwN

Signatures

Arrowrat family
arrowrat

File Explorer

2324-140-0x0000000000400000-0x000000000042C000-memory.dmp

.exe 176KB

2324-140-0x0000000000400000-0x000000000042C000-memory.dmp

SHA256 4e4dcd976d91fa65cc102b3a9a067852c0bfe2c080d46917d311ff46187cfa28
MD5 be9bb3085ed5cd7c5e3212addfafabde
SHA1 bb0080502f256430ad450b45a25c1effdb60b953
SHA512 dbf724492c5eecd4b3ef79039ff6cf0f11fa282904d489ef7ed51cddeceb9bf9320f59a19fb76c689d0d175127236f040e70b38c0815d6adb6396b5d7d685386
SSDEEP 3072:ebRH+0O5VbFHexuiCrK0ovzNC0Fie+5cVjvn+sZCh8/QbM768Y:ebRe0OLoxuiCNovpke+cvnOaQJ8
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

163806

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing