arrowrat | 79ec7c271adcd148064e5324c66d8ea9c1eefd81c44bde7c9ca754f4fb9d80b3[.]zip

General

Target

79ec7c271adcd148064e5324c66d8ea9c1eefd81c44bde7c9ca754f4fb9d80b3.zip
Size

78KB
MD5

f71ab3d0d751df0f11b68eca80ddd81c
SHA1

be19a278805ceadd26d379afafbce874be9526ea
SHA256

f9751562f934104cb3887e7a5da1cae472dbd2ea25d99fa2437aa59322088653
SHA512

e379cd9c64e9b9621e23c5d08fa184640e3a597ef879c36abbd3fd852a0b3257b448b148aa890bdbabd74d612f24246a0a5bd4aec3adf5ebaf1a8704a4a76690
SSDEEP

1536:3w0vnCoSzqPdkT7mnvltLOR+GQ78wjzHRjzSZUlb5gxXMXbghnvQA4:3w0azzqS74bmT+8wHHBm8bidMrghz4

Score

10^/10

client arrowrat

Family

arrowrat

Botnet

Client

C2

192.168.1.222:1337

Mutex

gWyxhRMMH

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/79ec7c271adcd148064e5324c66d8ea9c1eefd81c44bde7c9ca754f4fb9d80b3.exe

79ec7c271adcd148064e5324c66d8ea9c1eefd81c44bde7c9ca754f4fb9d80b3.zip
.zip

Password: infected
79ec7c271adcd148064e5324c66d8ea9c1eefd81c44bde7c9ca754f4fb9d80b3.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 153KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ