arktunnel | msvc[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
msvc.exe
Size 321KB
Sample261111-d9fg5aew9s
SHA256 fa6ee36e833f1dee44ed1dd6aa09b921a11ce5d49e2720ead773e98c487b156b
MD5 5d158d791914667ead0e474ba1783b8a
SHA1 3342d08f3ddda4e17d22983a6e047d54c8b08125
SHA512 ab5be7a851ec006cd5ca35435820d12dd6c7e544a2f0f75281ccffc4b8912f73c03b5ada7eb442cb3a0d6205cdd68a6781f602b7593ad6c1e30d2e5475211dd1
SSDEEP 6144:NxtBMQZUGHVsZK7LQAREfUdZaE81+Nb0W+9JqSVWDNp4LHSb5+8FUg8tFyyed6UM:NxtvZUGHVsQ7LQAREfUdZaEyW+9JqSki
TLSH
T117647D46AAD751F8C9870130125DB73FAB76520547145DFBC3A0CDB92963AE23A3B32E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

proxy tunnel loader arktunnel

Malware Config

Signatures

Family: ArkTunnel
ArkTunnel is a Windows proxy implant that tunnels connections over a WebSocket C2, written in C.
proxy tunnel loader arktunnel

Detects ArkTunnel WebSocket proxy implant 1 IoCs

resource	yara_rule
sample	family_arktunnel

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
msvc.exe

File Explorer

msvc.exe

.exe 321KB

msvc.exe

IMPHASH e6acc05e4a172010908a387703da3c8d
SHA256 fa6ee36e833f1dee44ed1dd6aa09b921a11ce5d49e2720ead773e98c487b156b
MD5 5d158d791914667ead0e474ba1783b8a
SHA1 3342d08f3ddda4e17d22983a6e047d54c8b08125
SHA512 ab5be7a851ec006cd5ca35435820d12dd6c7e544a2f0f75281ccffc4b8912f73c03b5ada7eb442cb3a0d6205cdd68a6781f602b7593ad6c1e30d2e5475211dd1
SSDEEP 6144:NxtBMQZUGHVsZK7LQAREfUdZaE81+Nb0W+9JqSVWDNp4LHSb5+8FUg8tFyyed6UM:NxtvZUGHVsQ7LQAREfUdZaEyW+9JqSki
TLSH
T117647D46AAD751F8C9870130125DB73FAB76520547145DFBC3A0CDB92963AE23A3B32E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects ArkTunnel WebSocket proxy implant
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

WSAGetLastError WSAIoctl WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt htonl htons inet_ntop inet_pton ioctlsocket listen ntohl ntohs recv recvfrom send sendto socket

iphlpapi

GetAdaptersAddresses GetAdaptersInfo GetBestRoute2

shlwapi

PathQuoteSpacesW

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AreFileApisANSI CloseHandle CopyFileA CreateFileA CreateIoCompletionPort CreateProcessA CreateThread DeleteCriticalSection DeleteFileA EnterCriticalSection FindClose FindFirstFileA FindNextFileA FormatMessageA GetComputerNameA GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceExA GetFileAttributesA GetHandleInformation GetLastError GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetQueuedCompletionStatusEx GetStartupInfoA GetSystemInfo GetSystemTimeAsFileTime GetTickCount64 GetTickCount GetTimeZoneInformation GetVersionExA GlobalMemoryStatusEx InitOnceExecuteOnce InitializeCriticalSection InitializeSRWLock IsDBCSLeadByte IsDBCSLeadByteEx LeaveCriticalSection LocalFree MoveFileA MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive ReleaseSRWLockShared SetCurrentDirectoryA SetEnvironmentVariableA SetFileCompletionNotificationModes SetLastError SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile

advapi32

ChangeServiceConfig2W CloseServiceHandle CreateServiceW DeleteService LookupAccountNameA OpenSCManagerW OpenServiceW QueryServiceStatus RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW StartServiceW

msvcrt

__lc_codepage __getmainargs __p___argc __p___argv __p___initenv __p___mb_cur_max __p__acmdln __p__commode __p__fmode __p__iob __set_app_type __setusermatherr _amsg_exit _cexit atexit _errno _initterm _lock _mkdir _stati64 _stricmp _unlock abort atoi calloc _close exit fclose fopen fprintf fputc free getc gmtime isdigit isleadbyte islower isspace isupper isxdigit localeconv localtime malloc mbstowcs memchr memcmp memcpy memmove memset mktime _open perror rand _read realloc signal _spawnl srand strchr strcmp strerror strftime strlen strncmp strrchr strtol strtoul time tmpnam tolower ungetc vfprintf wcscat wcslen _write

bcrypt

BCryptGenRandom

Name

.text

Size

259KB

Virtual Size

258KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

msvc.exe

ws2_32

iphlpapi

shlwapi

kernel32

advapi32

msvcrt

bcrypt

generic