Behavioral task
behavioral1
Sample
bJ99.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
bJ99.exe
Resource
win10v2004-20230220-en
General
-
Target
bJ99.exe
-
Size
138KB
-
MD5
2f73fdfb8140276968f2c1b358e5edf0
-
SHA1
160ec42cd31c98fdd91c8a837be32757b2b9af92
-
SHA256
5a45e4a32a4f2081b33dee2ab94eb3ebb4afafe0bd8f5b76e93dfe975c4a607c
-
SHA512
65c2ac40557d94cf715d720a3774547f10253fe00071cd6e1824f6304f02187e26184b7c064e8c5d0526bd8650e5854bae283cb080ea17ef3d007f28b0d477f3
-
SSDEEP
3072:+bvY5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/Yh:+bvwS7BqjjYHdrqkL/
Malware Config
Extracted
arrowrat
OJG36C
mayo21.duckdns.org:2158
NT7WTE
Signatures
-
Arrowrat family
Files
-
bJ99.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 136KB - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ