Behavioral task
behavioral1
Sample
Client.exe
Resource
win10v2004-20240730-en
General
-
Target
Client.exe
-
Size
158KB
-
MD5
5e59614770589b6f9ccd26931cedbf45
-
SHA1
dc5ee9bcda9d90c24574b9e420842c9a8789f1a3
-
SHA256
66475b24c13dab1ac718c17eb8a36a19c965144026c87ab504a73ced3896e43c
-
SHA512
2a8eaf627a11962ae5de96c6d2147c45094ecac1a547560aed8d451341998b1b0a7dbcdc957bee98b3bb270d5538129d12e53c6758129fc28cca250b064e2d34
-
SSDEEP
3072:HbzFH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfP6ZO8Y:HbzFe0ODhTEPgnjuIJzo+PPcfP608
Malware Config
Extracted
arrowrat
Windows Anti Virus Detections
and-statements.gl.at.ply.gg2a04:4a43:976f:fbc4:a03b:6599:d257:fc04:43442
xNageaqsy
Signatures
-
Arrowrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource Client.exe
Files
-
Client.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 153KB - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ