Behavioral task
behavioral1
Sample
Client.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Client.exe
Resource
win10v2004-20231023-en
General
-
Target
Client.exe
-
Size
158KB
-
MD5
fbe2de3a8f343b1e923a8f5176f1fcf3
-
SHA1
9bf0f79d9110d7580be60da0d574863411074c92
-
SHA256
151e25188fd745e3018605af4df7da77bc6cb5bd105978e667a371662646a288
-
SHA512
225727fc2b982494b7644a1301367aa17be10c2f1c696df200bc8543805fbf44e2a3a266fc961917fc963fce43d9c7bee6b72d3d89c5565c770e30bcfa2839d7
-
SSDEEP
3072:TbzGH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfP6OO8Y:TbzGe0ODhTEPgnjuIJzo+PPcfP6B8
Malware Config
Extracted
arrowrat
Client
147.185.221.16:40164
RnmYPKijw
Signatures
-
Arrowrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Client.exe
Files
-
Client.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 153KB - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ