Analysis
-
max time kernel
148s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
04-05-2023 12:31
General
-
Target
arrow/4a09a7db3729524b264f61bd57d422714e43167d391eae1df73cad90c2982d07.exe
-
Size
65KB
-
MD5
dece5aade19a0a646a41e40fe42deda3
-
SHA1
1ef25d469b835fcb3f4e1a10d894e0779a297730
-
SHA256
4a09a7db3729524b264f61bd57d422714e43167d391eae1df73cad90c2982d07
-
SHA512
8a5bbffe0cad2c85df2b305dcde269ceee70804bde2c26bea0b55e09fd79ce47fffdcfff19e3f21baa1254cde4aa89c9597945b18d666a13f075c45d4a74b3e5
-
SSDEEP
1536:mnhjtb22D0b82c1rVjB1bbsSxResZf+aswNpqKmY7:mnP22wbg1f1bbsSbxKwWz
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
ArrowRAT 1.0.2.0
Botnet
ArrowRAT Clients
C2
arrw.duckdns.org:5557
Mutex
ArrowRAT_Mutex_ArrowRAT
Attributes
-
delay
0
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\arrow\4a09a7db3729524b264f61bd57d422714e43167d391eae1df73cad90c2982d07.exe"C:\Users\Admin\AppData\Local\Temp\arrow\4a09a7db3729524b264f61bd57d422714e43167d391eae1df73cad90c2982d07.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
-
Filesize
512KB
-
Filesize
512KB