arrowrat | ClientH[.]exe

General

Target
ClientH.exe
Size 90KB
Sample230419-pzzc2aae79
SHA256 4ce0eb37a2076db86260f2dbf67dbc34c5e5c79e2fa7895458b5113ea308a2ba
MD5 b296864bb2a6846e9b1a59b6e613f7b3
SHA1 529c91595ea7b43ca93c1ad55d7f445841e9f536
SHA512 77a16f9c3e5b6a983f24618cdcfd65d8dedef2995c3f9399f4c73b11b1b4b0ed8927c69aed3ceda9c4e7151a46263dc085a17fbdaf3ae6a8de691551708fcd7e
SSDEEP 1536:tbRiQM/57SK3bUzZdQ1iIMvnZlbLxjV3AGq5gWlocT1wzySsd9NJ33v:tbR457SKsstcnZTJQDgWPaySsdH5/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

venomhvnc arrowrat

Malware Config

Extracted

Family

arrowrat

Botnet

VenomHVNC

C2

notfishvr3333338-52100.portmap.host:52100

Mutex

qCsPvqtHt.exe

Signatures

Arrowrat family
arrowrat

File Explorer

ClientH.exe

.exe 90KB

ClientH.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 4ce0eb37a2076db86260f2dbf67dbc34c5e5c79e2fa7895458b5113ea308a2ba
MD5 b296864bb2a6846e9b1a59b6e613f7b3
SHA1 529c91595ea7b43ca93c1ad55d7f445841e9f536
SHA512 77a16f9c3e5b6a983f24618cdcfd65d8dedef2995c3f9399f4c73b11b1b4b0ed8927c69aed3ceda9c4e7151a46263dc085a17fbdaf3ae6a8de691551708fcd7e
SSDEEP 1536:tbRiQM/57SK3bUzZdQ1iIMvnZlbLxjV3AGq5gWlocT1wzySsd9NJ33v:tbR457SKsstcnZTJQDgWPaySsdH5/
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

98046

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing