arvionrat | cc9003725c96302ebfde15f84697cf47fad692ea2a0328b3962df262019e4610

Sharing

Copy URL Twitter E-mail

General

Target
cc9003725c96302ebfde15f84697cf47fad692ea2a0328b3962df262019e4610
Size 1006KB
Sample260910-lesg7san4x
SHA256 cc9003725c96302ebfde15f84697cf47fad692ea2a0328b3962df262019e4610
MD5 5f1bde589e9c24c066e1ad90372da5ab
SHA1 f8a1174cdd5d43c24d062070cc5a8f3bd8f79cd8
SHA512 5e5c10edb5468f5c668298537885ccb37b8f7a85c06c77e162b0d73a4a23b878e6d24c8dce9f6566956f7d958780c5570b92f33fceb66e7463dde7062580dd12
SSDEEP 24576:5CKkVy4nKWP/xozhcXg60dLNmvWYGsEgfphaO9:8BHnx/xozhcXg6WLNu0s
TLSH
T1A6256C19AE9402BAE176D078CEA75453F773B80603319EEB079199653F336E09E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

exil rat arvionrat

Malware Config

Extracted

Family

arvionrat

Campaign

exil

193.233.126.2:9997
193.233.126.2:9999
193.233.126.2:10000

Mutex

WinDrvHostMutex9x

Signatures

Family: ArvionRAT
ArvionRAT is a Windows RAT written in C++.
rat arvionrat

Detects ArvionRAT 1 IoCs

resource	yara_rule
sample	family_arvionrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cc9003725c96302ebfde15f84697cf47fad692ea2a0328b3962df262019e4610

File Explorer

cc9003725c96302ebfde15f84697cf47fad692ea2a0328b3962df262019e4610

.exe 1006KB

cc9003725c96302ebfde15f84697cf47fad692ea2a0328b3962df262019e4610

IMPHASH 9f9330d3db52476a7e59a288675657f8
SHA256 cc9003725c96302ebfde15f84697cf47fad692ea2a0328b3962df262019e4610
MD5 5f1bde589e9c24c066e1ad90372da5ab
SHA1 f8a1174cdd5d43c24d062070cc5a8f3bd8f79cd8
SHA512 5e5c10edb5468f5c668298537885ccb37b8f7a85c06c77e162b0d73a4a23b878e6d24c8dce9f6566956f7d958780c5570b92f33fceb66e7463dde7062580dd12
SSDEEP 24576:5CKkVy4nKWP/xozhcXg60dLNmvWYGsEgfphaO9:8BHnx/xozhcXg6WLNu0s
TLSH
T1A6256C19AE9402BAE176D078CEA75453F773B80603319EEB079199653F336E09E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects ArvionRAT
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

502384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Пользователь\source\repos\agent\x64\Release\agent.pdb

kernel32

CreateEventW MultiByteToWideChar Sleep GetTickCount64 GetLastError GetFileAttributesExW Process32NextW K32GetProcessMemoryInfo CreateFileA SetEvent FileTimeToSystemTime GetDiskFreeSpaceExW GetSystemDirectoryA LoadLibraryA LockResource DeleteFileA GlobalAlloc DeleteFileW Process32FirstW GlobalFree CloseHandle K32GetModuleBaseNameA GetSystemInfo LoadLibraryW CreateThread LoadResource FindResourceW SetFileAttributesA FileTimeToLocalFileTime Module32FirstW GetLocalTime K32EnumProcesses GetWindowsDirectoryW GetProcAddress GlobalLock SetFilePointerEx VirtualAllocEx CreateFileMappingA LocalFree MoveFileExW WTSGetActiveConsoleSessionId GetFileSize ExitProcess GetComputerNameW GetCurrentProcessId GlobalMemoryStatusEx CreateProcessW GetModuleHandleW FreeLibrary CopyFileW FlushInstructionCache WideCharToMultiByte CreateRemoteThread Module32NextW QueryFullProcessImageNameW GetTempFileNameW CreateProcessA K32EnumProcessModules GetDiskFreeSpaceExA VirtualFreeEx MapViewOfFile GetTickCount GlobalUnlock SetDllDirectoryW IsDebuggerPresent GetComputerNameA CheckRemoteDebuggerPresent FlushFileBuffers WriteConsoleW HeapSize GetConsoleMode GetConsoleOutputCP SetStdHandle GetProcessHeap PeekNamedPipe FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindFirstFileExW GetOEMCP GetACP IsValidCodePage HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID SetFileAttributesW GetLocaleInfoW LCMapStringW LoadLibraryExW GetFileType HeapAlloc HeapFree UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter OpenProcess GetModuleHandleA UnmapViewOfFile GetSystemDirectoryW GetCurrentThreadId GetFileAttributesW CreateFileW WaitForSingleObject GetVolumeInformationA FindClose CreateMutexW ExpandEnvironmentStringsA CreatePipe GetSystemTimes GetModuleFileNameW GetDriveTypeA RemoveDirectoryW TerminateProcess VirtualAlloc DeviceIoControl GetShortPathNameW ExpandEnvironmentStringsW WriteFile GetCurrentProcess FindNextFileW GetFullPathNameW VirtualFree SetLastError CreateDirectoryW VirtualProtect SetHandleInformation WriteProcessMemory GetFileSizeEx FindFirstFileW SetNamedPipeHandleState GetLogicalDrives GetVolumeInformationW QueryDosDeviceW SizeofResource ReadFile GetStringTypeW WakeAllConditionVariable GetCPInfo CompareStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection LCMapStringEx SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive QueryPerformanceFrequency QueryPerformanceCounter CreateToolhelp32Snapshot IsValidLocale GetTempPathW

user32

SetForegroundWindow UpdateWindow SwapMouseButton SetProcessDPIAware SystemParametersInfoW ToUnicode SetClipboardData SetWindowsHookExW ClipCursor LoadCursorW GetClipboardData TranslateMessage OpenInputDesktop EnumWindows UnhookWindowsHookEx ReleaseDC GetCursorPos SendInput GetWindowTextLengthW SetCursorPos SendMessageTimeoutW GetMonitorInfoA BlockInput GetWindowTextW DestroyWindow RegisterClassW PeekMessageW ExitWindowsEx EmptyClipboard CloseClipboard DispatchMessageW OpenClipboard CloseDesktop GetAsyncKeyState IsWindow ShowWindow SetThreadDesktop RegisterClassExW SetWindowTextW GetDC IsWindowVisible MessageBoxW EnumDisplayMonitors CreateWindowExW GetSystemMetrics CallNextHookEx SendMessageW GetMessageW DefWindowProcW GetKeyState PostMessageW GetWindow GetFocus GetWindowThreadProcessId GetLastInputInfo

gdi32

SetStretchBltMode CreateCompatibleBitmap SelectObject CreateDIBSection CreateCompatibleDC StretchBlt GetStockObject DeleteDC SetDIBits DeleteObject

advapi32

RegCreateKeyExW RegQueryValueExW LookupPrivilegeValueW AdjustTokenPrivileges RevertToSelf RegCloseKey RegEnumKeyW SetFileSecurityW QueryServiceStatus CloseServiceHandle OpenSCManagerW RegDeleteKeyW ControlService RegEnumKeyExW ImpersonateLoggedOnUser RegDeleteTreeW RegSetValueExW OpenProcessToken StartServiceW RegOpenKeyExW CreateProcessAsUserW RegDeleteValueW OpenServiceW ConvertStringSecurityDescriptorToSecurityDescriptorW GetUserNameW DuplicateTokenEx GetTokenInformation

shell32

ShellExecuteExW SHGetKnownFolderPath SHGetFolderPathW ShellExecuteW

ole32

CoUninitialize CoInitializeEx CLSIDFromString IIDFromString CoSetProxyBlanket CreateStreamOnHGlobal CoTaskMemFree CoCreateInstance PropVariantClear

oleaut32

SysAllocStringByteLen SysAllocString VariantClear VariantInit SysStringByteLen SysFreeString

ws2_32

connect socket send recv getsockopt WSAStartup htons freeaddrinfo ioctlsocket setsockopt WSACleanup __WSAFDIsSet WSAIoctl closesocket select inet_pton getaddrinfo WSAGetLastError

gdiplus

GdipGetImageEncodersSize GdipGetImageGraphicsContext GdipSetPixelOffsetMode GdipGraphicsClear GdipSetInterpolationMode GdipFree GdipDrawImageRectRectI GdipDeleteGraphics GdipGetImageWidth GdipCreateBitmapFromFile GdipSaveImageToStream GdipCreateBitmapFromScan0 GdipSaveImageToFile GdipDisposeImage GdipCreateBitmapFromHBITMAP GdiplusStartup GdiplusShutdown GdipGetImageHeight GdipGetImageEncoders GdipCloneImage GdipAlloc GdipDrawImageRectI

winmm

PlaySoundW waveOutGetNumDevs mciSendStringW waveInGetDevCapsW waveInGetNumDevs

urlmon

URLDownloadToFileW

crypt32

CryptUnprotectData

bcrypt

BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptDecrypt BCryptOpenAlgorithmProvider BCryptDestroyKey

ncrypt

NCryptOpenStorageProvider NCryptOpenKey NCryptFreeObject NCryptDecrypt

wtsapi32

WTSQueryUserToken

vssapi

VssFreeSnapshotPropertiesInternal CreateVssBackupComponentsInternal

iphlpapi

GetAdaptersAddresses

d3d11

D3D11CreateDevice

Name

.text

Size

663KB

Virtual Size

663KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

162KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

146KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

cc9003725c96302ebfde15f84697cf47fad692ea2a0328b3962df262019e4610

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ws2_32

gdiplus

winmm

urlmon

crypt32

bcrypt

ncrypt

wtsapi32

vssapi

iphlpapi

d3d11

generic