Overview

overview

10

Static

static

10

2026-02-11...ar.exe

windows11-ltsc_2024-x64

10

Resubmissions

11/11/2026, 01:44

261111-b58xrsds6q10

10/11/2026, 10:21

261110-mdme8s11ay10

11/02/2026, 07:20

260211-h54rdaby9b7

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-02-11_8e63bf1232e3d401f2c42afeee96d2f6_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
  • Size 13.4MB
  • Sample261111-b58xrsds6q
  • SHA256 9ca08f9fe3fd94a0b66bce740dad4923fe7e3c39f7e1e3a8d7674c72f32c7f3a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
arktunnel1.32.win.06loaderpersistenceproxyransomwaretunnel

Malware Config

Extracted

Family

  • arktunnel

Version

  • 1.32

Campaign

  • 1.32.win.06

C2

  • reg.pcflyer.ca:443/ws

Targets

    • Target
      2026-02-11_8e63bf1232e3d401f2c42afeee96d2f6_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
    • Size 13.4MB
    • SHA256 9ca08f9fe3fd94a0b66bce740dad4923fe7e3c39f7e1e3a8d7674c72f32c7f3a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    arktunnelloaderpersistenceproxyransomwaretunnel

    • Detects ArkTunnel WebSocket proxy implant

    • Family: ArkTunnel

      ArkTunnel is a Windows proxy implant that tunnels connections over a WebSocket C2, written in C.

      proxytunnelloaderarktunnel
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks