arrowrat | 1324-63-0x0000000000400000-0x000000000042E000-memory[.]dmp

General

Target
1324-63-0x0000000000400000-0x000000000042E000-memory.dmp
Size 184KB
Sample240302-lglsfaca41
SHA256 60dcc22749c56a89b146e19d944ef2ea9bf6722676ebb5e0bbcb180d9dc645d1
MD5 82a5020c06f628e494288bdaad2f7ee4
SHA1 e21ff1e0754f94b764aa899ad703df5e8caefce5
SHA512 d9149f11e328b0cce1043892382bcf7034c15eed764edd59856a03f9bad7943ec5ffa3048a44ae0b8ac63f5c79bd2ead795ddfff01b47e9e1479779b34c5be74
SSDEEP 3072:DbRW0+0OTmlxvTltwLpBTkgIDeGIl3WNSmNJR1GddKqeCgqVbbp/YouwJbVU8QKX:DbRq0OWdltyB7dWY0J6ddKwpgouYj8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

company arrowrat

Malware Config

Extracted

Family

arrowrat

Botnet

company

C2

103.178.236.127:1337

Mutex

pKfaPMMUE

Signatures

Arrowrat family
arrowrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1324-63-0x0000000000400000-0x000000000042E000-memory.dmp

File Explorer

1324-63-0x0000000000400000-0x000000000042E000-memory.dmp

.exe 184KB

1324-63-0x0000000000400000-0x000000000042E000-memory.dmp

SHA256 60dcc22749c56a89b146e19d944ef2ea9bf6722676ebb5e0bbcb180d9dc645d1
MD5 82a5020c06f628e494288bdaad2f7ee4
SHA1 e21ff1e0754f94b764aa899ad703df5e8caefce5
SHA512 d9149f11e328b0cce1043892382bcf7034c15eed764edd59856a03f9bad7943ec5ffa3048a44ae0b8ac63f5c79bd2ead795ddfff01b47e9e1479779b34c5be74
SSDEEP 3072:DbRW0+0OTmlxvTltwLpBTkgIDeGIl3WNSmNJR1GddKqeCgqVbbp/YouwJbVU8QKX:DbRq0OWdltyB7dWY0J6ddKwpgouYj8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1960410351

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing