Overview

overview

10

Static

static

10

ProctorU.1...V2.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ProctorU.1.32.win.06V2.exe.bin
  • Size 13.4MB
  • Sample261111-d6v4eaew8w
  • SHA256 9ca08f9fe3fd94a0b66bce740dad4923fe7e3c39f7e1e3a8d7674c72f32c7f3a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
arktunnel1.32.win.06discoveryloaderpersistenceproxyransomwaretunnel

Malware Config

Extracted

Family

  • arktunnel

Version

  • 1.32

Campaign

  • 1.32.win.06

C2

  • reg.pcflyer.ca:443/ws

Targets

    • Target
      ProctorU.1.32.win.06V2.exe.bin
    • Size 13.4MB
    • SHA256 9ca08f9fe3fd94a0b66bce740dad4923fe7e3c39f7e1e3a8d7674c72f32c7f3a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryarktunnelloaderpersistenceproxyransomwaretunnel

    • Detects ArkTunnel WebSocket proxy implant

    • Family: ArkTunnel

      ArkTunnel is a Windows proxy implant that tunnels connections over a WebSocket C2, written in C.

      proxytunnelloaderarktunnel

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks