Analysis
-
max time kernel
91s -
max time network
202s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
16/11/2024, 13:28 UTC
General
-
Target
Plugins/9Ood5SWkbwPn.exe
-
Size
138KB
-
MD5
2cf2efcc0e1d910d2d9c933ca73055d0
-
SHA1
3bb08f4532f80bf0cd5a36f26393ba00beadb8eb
-
SHA256
2475c46eba856424c41cf41db71fd5d6089e8be9031b35279f051da760aa216f
-
SHA512
e16ca929bf2c7654251b02946fa7954f89971a27750e05c502acede063a55d88df16fb297c40c7bf54e04ea173cb6c3527e65ca98ad2280543e00e9ef6fa9390
-
SSDEEP
3072:ubvh/X2z7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/Yi:ubvhPi7BqjjYHdrqkL/
Score
10/10
Malware Config
Extracted
Family
arrowrat
Botnet
identifier
C2
IP:PORT
Mutex
mutex
Signatures
-
ArrowRat
Remote access tool with various capabilities first seen in late 2021.
-
Arrowrat family
Processes
-
C:\Users\Admin\AppData\Local\Temp\Plugins\9Ood5SWkbwPn.exe"C:\Users\Admin\AppData\Local\Temp\Plugins\9Ood5SWkbwPn.exe"1⤵
Network
-
DNS31.243.111.52.in-addr.arpaRemote address:8.8.8.8:53Request31.243.111.52.in-addr.arpaIN PTRResponse
No results found
-
8.8.8.8:5331.243.111.52.in-addr.arpadns
DNS Request
31.243.111.52.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
160KB