Behavioral task
behavioral1
Sample
Client.exe
Resource
win10v2004-20230220-en
General
-
Target
Client.exe
-
Size
157KB
-
MD5
c4d6588bee90ee0c7dd9b674199b0302
-
SHA1
a3b5f94a66b3198046fec3dd72c0399b6767e5d3
-
SHA256
f902c427484c65c3bcd1543072e4c53da376a7ba6151fb6d1ccd990bb7a94be2
-
SHA512
24b7ccf87ec5cc5e3af783a6500b1de4f8a381f31e0baf96f7755cca2a92afee310bcfb3c3bf8b7c033f4161f9b53bbcbd605ee281861e3cd59727870e795a8f
-
SSDEEP
3072:+bR3+0O5VbFHexuiCrK0ovzNC0Fie+5cVjvn+sZCh8/QbHb68Y:+bRu0OLoxuiCNovpke+cvnOaQ68
Malware Config
Extracted
arrowrat
Client
194.ip.ply.gg:54552
oWzurbWMF
Signatures
-
Arrowrat family
Files
-
Client.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 152KB - Virtual size: 151KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ