Behavioral task
behavioral1
Sample
Client.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
Client.exe
Resource
win10v2004-20241007-en
General
-
Target
Client.exe
-
Size
158KB
-
MD5
16a66efc62e16195848483277f81cb3b
-
SHA1
5b3b70e9df9b025576386abfa9ed7c342e8d7a46
-
SHA256
e694001c6e68ee030e201b680d2e1916ee121fe76f050121045a3fa2465e3ed6
-
SHA512
87d682acb2b44506711e4758762e16c3f29101c5a20c1b144ff2c337c37a82f8bd0bbf13c65bb1e5e2423bcf3f042cd9d114256846aeb5c8e66119b64d6d1393
-
SSDEEP
3072:gbzxH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfPMiO8Y:gbzxe0ODhTEPgnjuIJzo+PPcfPMd8
Malware Config
Extracted
arrowrat
Pf030dc1ckld12od3
192.168.1.46:1337
QplfyCtwT
Signatures
-
Arrowrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource Client.exe
Files
-
Client.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 153KB - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ