Overview

overview

10

Static

static

10

Anarchy RA...ed.zip

windows10-2004-x64

1

Anarchy.exe

windows10-2004-x64

10

Anarchy.exe.xml

windows10-2004-x64

5

Plugins/0g...oG.dll

windows10-2004-x64

1

Plugins/59...uJ.dll

windows10-2004-x64

1

Plugins/9O...Pn.exe

windows10-2004-x64

10

Plugins/EV...LC.dll

windows10-2004-x64

1

Plugins/FBSyChwp.dll

windows10-2004-x64

1

Plugins/G3...uZ.dll

windows10-2004-x64

1

Plugins/K8...WP.dll

windows10-2004-x64

1

Plugins/KN...Hs.dll

windows10-2004-x64

1

Plugins/PK...TS.dll

windows10-2004-x64

1

Plugins/Recovery.dll

windows10-2004-x64

1

Plugins/Rs...xj.dll

windows10-2004-x64

1

Plugins/Wk...pi.dll

windows10-2004-x64

1

Plugins/fzAgyDYa.dll

windows10-2004-x64

1

Plugins/mM...GA.dll

windows10-2004-x64

1

Plugins/ma...EC.dll

windows10-2004-x64

1

Plugins/oYsKwDG.dll

windows10-2004-x64

1

Plugins/sJ...zK.dll

windows10-2004-x64

1

Plugins/yL...2P.dll

windows10-2004-x64

1

Plugins/zV...LS.dll

windows10-2004-x64

1

Stub/Stub.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Anarchy RAT v4.4 Cracked.zip

  • Size

    22.2MB

  • MD5

    8e86e6a0bba0edd5e2f17693ab38fccf

  • SHA1

    fb250476b00bbe2e9ca889465f61cc51abcc49eb

  • SHA256

    96530315fa4e725f9f1cadf145b84119a53911944bcd4f92e2b577d30c5f98bb

  • SHA512

    55f4f82e37a83ff908e49722654858b39b40e4129ffc55e8a4a72b2c73f2bd64cf50d89f7ada76d456cc9d3dae0fe6f47c77631b7cc4df1303ee8281e996108e

  • SSDEEP

    393216:Ecjii1tIIN4Zs2v89tfMoOwoe7Joj3Eks39FJbXHuXjvNW9K4a2J4yfXF7io8eXL:Aio5Vvfbl7Vs3ztXoZW9K4aC1FO+KE

Score
10/10
agilenetratidentifierasyncratarrowrat

Malware Config

Extracted

Family

arrowrat

Botnet

identifier

C2

IP:PORT

Mutex

mutex

Signatures

  • Arrowrat family
    arrowrat
  • Async RAT payload 17 IoCs
    rat
  • Asyncrat family
    asyncrat
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

Files

  • Anarchy RAT v4.4 Cracked.zip
    .zip
  • Anarchy.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Anarchy.exe.config
    .xml
  • Plugins/0guo3zbo66fqoG.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/59Zp7paEHDF7luJ.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/9Ood5SWkbwPn.AnarHs
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugins/EVa7gBMKoaHmLC.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/FBSyChwp.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/G3nl0mDcABnDuZ.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/K8oCBS3ThnW0WP.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/KNTmoSnG.AnarHs.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/PK0TcnqTGFagQTS.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Recovery.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/RssCnLKcGRxj.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/WkUP83aP9CABpi.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/fzAgyDYa.AnarHs
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/mML6WKMqdxjDGA.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/maSN8TBMgUEC.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/oYsKwDG.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/sJ88z8tsg5XzK.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/yL9x34D8X3oO2P.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/zVvPGvK64uLS.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Stub/Stub.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections