Overview

overview

10

Static

static

10

Anarchy.exe

windows7-x64

1

Anarchy.exe

windows10-2004-x64

10

Anarchy.exe.xml

windows7-x64

1

Anarchy.exe.xml

windows10-2004-x64

1

Plugins/0g...oG.dll

windows7-x64

1

Plugins/0g...oG.dll

windows10-2004-x64

1

Plugins/59...uJ.dll

windows7-x64

1

Plugins/59...uJ.dll

windows10-2004-x64

1

Plugins/9O...Pn.exe

windows7-x64

10

Plugins/9O...Pn.exe

windows10-2004-x64

10

Plugins/EV...LC.dll

windows7-x64

1

Plugins/EV...LC.dll

windows10-2004-x64

1

Plugins/FBSyChwp.dll

windows7-x64

1

Plugins/FBSyChwp.dll

windows10-2004-x64

1

Plugins/G3...uZ.dll

windows7-x64

1

Plugins/G3...uZ.dll

windows10-2004-x64

1

Plugins/K8...WP.dll

windows7-x64

1

Plugins/K8...WP.dll

windows10-2004-x64

1

Plugins/KN...Hs.dll

windows7-x64

1

Plugins/KN...Hs.dll

windows10-2004-x64

1

Plugins/PK...TS.dll

windows7-x64

1

Plugins/PK...TS.dll

windows10-2004-x64

1

Plugins/Recovery.dll

windows7-x64

1

Plugins/Recovery.dll

windows10-2004-x64

1

Plugins/Rs...xj.dll

windows7-x64

1

Plugins/Rs...xj.dll

windows10-2004-x64

1

Plugins/Wk...pi.dll

windows7-x64

1

Plugins/Wk...pi.dll

windows10-2004-x64

1

Plugins/fzAgyDYa.dll

windows7-x64

1

Plugins/fzAgyDYa.dll

windows10-2004-x64

1

Plugins/mM...GA.dll

windows7-x64

1

Plugins/mM...GA.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    New WinRAR ZIP archive.zip

  • Size

    23.3MB

  • MD5

    061875ef25c5aae8f11daa282b89e2a5

  • SHA1

    3e281c48ae8f10761ff2ec0d8735e615b315e796

  • SHA256

    ef06baf5e993b383ff6606608bf3ead3fb66748017fd4e1ca97acb25f08c70eb

  • SHA512

    237197e7f99636ee0e4c4b7312c8f92a93d4bbf5c0f4ebfa91ae2f39d2611d6ad81b7e4a0c742d91b0141a37befadd11cc382b0b7ab0aa21d8d6bb90ecf6f49a

  • SSDEEP

    393216:fiKIT1+eg8gucGB7m2m9UujapA0zhIzKGaItvd0TPY1lHcYxc/U4Pl51Zb2iM/Ia:fiKIh+egO1mXFO3tIzK6eDImYxc/U4fu

Score
10/10
agilenetratidentifierasyncratarrowrat

Malware Config

Extracted

Family

arrowrat

Botnet

identifier

C2

IP:PORT

Mutex

mutex

Signatures

  • Arrowrat family
    arrowrat
  • Async RAT payload 17 IoCs
    rat
  • Asyncrat family
    asyncrat
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

Files

  • New WinRAR ZIP archive.zip
    .zip
  • Anarchy.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Anarchy.exe.config
    .xml
  • Plugins/0guo3zbo66fqoG.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/59Zp7paEHDF7luJ.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/9Ood5SWkbwPn.AnarHs
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Plugins/EVa7gBMKoaHmLC.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/FBSyChwp.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/G3nl0mDcABnDuZ.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/K8oCBS3ThnW0WP.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/KNTmoSnG.AnarHs.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/PK0TcnqTGFagQTS.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Recovery.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/RssCnLKcGRxj.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/WkUP83aP9CABpi.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/fzAgyDYa.AnarHs
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/mML6WKMqdxjDGA.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/maSN8TBMgUEC.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/oYsKwDG.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/sJ88z8tsg5XzK.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/yL9x34D8X3oO2P.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/zVvPGvK64uLS.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Stub/Stub.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • ndp48-web.exe
    .exe windows x86

    9b2f6a441f9ff8df98ae6e9e6b5d4271


    Code Sign

    Headers

    Imports

    Exports

    Sections