Overview

overview

10

Static

static

10

Guna.UI2.dll

windows10-1703-x64

1

Guna.UI2.dll

windows10-2004-x64

1

Guna.UI2.dll

windows11-21h2-x64

1

PandorahVNC.exe

windows10-1703-x64

7

PandorahVNC.exe

windows10-2004-x64

7

PandorahVNC.exe

windows11-21h2-x64

7

client.exe

windows10-1703-x64

10

client.exe

windows10-2004-x64

10

client.exe

windows11-21h2-x64

10

dnlib.dll

windows10-1703-x64

1

dnlib.dll

windows10-2004-x64

1

dnlib.dll

windows11-21h2-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PANDORA HVNC Cracked.zip.zip

  • Size

    4.1MB

  • Sample

    240629-a3p67szdjm

  • MD5

    0f8b506d7925457584afdd8a8d295d7c

  • SHA1

    3d99cf175cd6de9962086ebbd890eded2e92df0c

  • SHA256

    393c7e77b02c57fab99cc076e29bd439ca049cacdbd9f7511177aa3ffd8d9b01

  • SHA512

    ad6c80562f6dc2f27a8508c1df5429c9a639b17834e35705863dc15b349d912f0cca83d1cd49f82b3377c2a4e43eedad199db0faf2f32dd659a91708818557d4

  • SSDEEP

    98304:7mvy5sIojJCe5CfOjoxj887wYfHcL/ljN2qsWDdoEzjzENqZdwP:7mK5snCfOjg8a8LdQqzawjYqy

Score
10/10
arrowratidentifieragilenetrat

Malware Config

Extracted

Family

arrowrat

Botnet

identifier

C2

IP:PORT

Mutex

mutex

Targets

    • Target

      Guna.UI2.dll

    • Size

      2.1MB

    • MD5

      d65fd6dbbd3c9ac74139aeaedc4a5816

    • SHA1

      407ae10ccc8e19798bf75cb90b2150cb63a9db66

    • SHA256

      84199a22c8669a39800272c3da0d969ec4e8d77d67b9d324ca049953a5042c71

    • SHA512

      b8a99e88d49a6f9ff89339fa5acc9df8b59665d2ec22ccb4741e501bba6b280b00336906a637d8f071f86a4dcd68ca4ac86683e651466f084cb96d0e3152eddf

    • SSDEEP

      49152:ClU6fD73waJnBA5lV8jldVmIgA5iKOvhn:ClU6vznglEldVmIJi/vt

    Score
    1/10
    behavioral1behavioral2behavioral3

    • Target

      PandorahVNC.exe

    • Size

      3.9MB

    • MD5

      39ef11e7673738d7dab6b7396044d003

    • SHA1

      f372b46ae504c6ce04dc6cb4d3673254bb22c73f

    • SHA256

      eced18f42cc7a54e40444f42b4ee3a200022837b66235e5239cebe0ab96a2740

    • SHA512

      d371b47ee1e0327f63ed775dadbbec906985b73ec3d4e07f6ea43d418f7c61f34b4917de046c766c9e0c6d3b171f436a7a6751a1ae7b8f23bcbb73374bf41423

    • SSDEEP

      49152:Mb71HC2cya/D83eCsQ3+CIwiRncZe65rb5p0ehFCrHC2cya/:MbdC25oD837+CIwgSe6NtsC25o

    Score
    7/10
    agilenet

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet
    behavioral4behavioral5behavioral6

    • Target

      client.bin

    • Size

      139KB

    • MD5

      60b39085c266f364c6b1269ab8fe79f5

    • SHA1

      2ddc84df80f3404875706ee00fa43f5ffaf922f2

    • SHA256

      ad45703ebdfd43596469416bc9e24374d77a6f361057a31b6cc659789522da75

    • SHA512

      f3d36ed6003a6cffceed0e48426ff438d427a38711b25313778541cd528f05f4e6ab521fcfde84914b22f71de7325c53976fdb8fb8d56b21c782e521d050ccd9

    • SSDEEP

      3072:NbR8P5sz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/Yl:NbR8hI7BqjjYHdrqkL/

    Score
    10/10
    arrowratidentifierrat

    • ArrowRat

      Remote access tool with various capabilities first seen in late 2021.

      ratarrowrat
    behavioral7behavioral8behavioral9

    • Target

      dnlib.dll

    • Size

      1.1MB

    • MD5

      e517eaeabd955f1e0f83ed04a0e6dd86

    • SHA1

      4a376b09ca00c7b934f6b444302773d0420ebd85

    • SHA256

      d04369e2fafabb36fdc31fc63b9a4bfd2bba577a203ee8180f9b084d9b344676

    • SHA512

      3c416235e0bb395b000b75f1358bde869c0ba2ff554b64821f5729f0580349fd8d1ba99ebc80e4b6dffa7b4741b4bb45570781d568fa9f5e3272de5d9108fe6c

    • SSDEEP

      24576:qM8euVMm3NxPkVCHKJi9n/PfuMs31MkZxxYyULZ4GBXcO1QmPyu9IFCh2v1DZS31:vhbivwS2IPx+vn

    Score
    1/10
    behavioral10behavioral11behavioral12

MITRE ATT&CK Matrix

Tasks