General
-
Target
Arctic.exe
-
Size
17.4MB
-
Sample
240527-yaxycafd6v
-
MD5
b5343da0e0f7cc78266f8282138f6bfc
-
SHA1
fdbb82d380e98a48a58de021b90f116cedc01298
-
SHA256
3e81ac827824478a5532846c42bdbf5d469beab9793092542419d0c5ebcf52ac
-
SHA512
01b5787a93d971f36238d9754db108e5d8133ccde528e7250c0e1acc3d3693f8a628d12fc8f14cdfff55236c0549e55a679b432f7f0e59f1c1bf7ec7ae2e2abf
-
SSDEEP
393216:jCSARbMb/m3pbsLG/PcjGsoTZleDXdk5I8g8F9/75oQlvQ+:+SkMbKx/PcsTZlofAFZlvQ
Behavioral task
behavioral1
Sample
Arctic.exe
Resource
win11-20240426-en
Malware Config
Targets
-
-
Target
Arctic.exe
-
Size
17.4MB
-
MD5
b5343da0e0f7cc78266f8282138f6bfc
-
SHA1
fdbb82d380e98a48a58de021b90f116cedc01298
-
SHA256
3e81ac827824478a5532846c42bdbf5d469beab9793092542419d0c5ebcf52ac
-
SHA512
01b5787a93d971f36238d9754db108e5d8133ccde528e7250c0e1acc3d3693f8a628d12fc8f14cdfff55236c0549e55a679b432f7f0e59f1c1bf7ec7ae2e2abf
-
SSDEEP
393216:jCSARbMb/m3pbsLG/PcjGsoTZleDXdk5I8g8F9/75oQlvQ+:+SkMbKx/PcsTZlofAFZlvQ
Score7/10-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-