arrowrat | bed2bd14e055123720101f9e031c159eb544c107a862fbec1f6f552036eeaf69

General

Target

bed2bd14e055123720101f9e031c159eb544c107a862fbec1f6f552036eeaf69
Size

69KB
MD5

cd28252b3a76874b5a7abf9c697612ca
SHA1

b1a58720a90c1c5b17d9c0ca4aa0da46d8350506
SHA256

bed2bd14e055123720101f9e031c159eb544c107a862fbec1f6f552036eeaf69
SHA512

8f79f1db2b00f8e381de3b1ebb99602b1ef0022f600b628bb5e05ae9f8b610fdfd7ea39f6bbe096cc095ca933de9b47cd257d033b2ef460125274df56d651ae4
SSDEEP

1536:Dc3ktB/Z/fyizqY6GMASu608Ti9GJSufFq/j5q4wC5tYzLV:DNXpz8G4dTi9GgqF+Y4w6Yt

Score

10^/10

sub70f arrowrat

Family

arrowrat

Botnet

SUB70F

C2

instruments-george.gl.at.ply.gg:12129

Mutex

58PJXL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/63ab8bad7e72c1c4044743b0de2efd791a4f9bf12e85b2bd973b7309d50eafc8.exe

bed2bd14e055123720101f9e031c159eb544c107a862fbec1f6f552036eeaf69
.zip

Password: infected
63ab8bad7e72c1c4044743b0de2efd791a4f9bf12e85b2bd973b7309d50eafc8.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ