arktunnel | 2358266014965da1fbcab4fff34a4d7c0d57e6582408ba48cc42c002f7370e2e

General

Target
ProctorU.1.32.win.08.bin
Size 9.8MB
Sample261111-d9geesew9v
SHA256 2358266014965da1fbcab4fff34a4d7c0d57e6582408ba48cc42c002f7370e2e
MD5 6fc7c24da89adad58981093910449095
SHA1 effc108a84ae4e2566d3466c52bb87a56f141345
SHA512 2de9126b002ca25686083400faff3c37feab9af568d2e84bb1ca2f8ee2993e9ce9f7416593bb88d9b629012b7591340113541c1320068e300973d2184a84b508
SSDEEP 196608:fnV1zWZSFD+oEQmAK3HFYUdt45FLOyomFHKnP:fV1uSh9EQm3FYw45F
TLSH
T12EA63B03BF5829E4EA456D3001B64B0F939AFD453A366B8F1B09BA1D9FF73C12E41586
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  ProctorU.1.32.win.08.bin
- Size 9.8MB
- SHA256 2358266014965da1fbcab4fff34a4d7c0d57e6582408ba48cc42c002f7370e2e
- MD5 6fc7c24da89adad58981093910449095
- SHA1 effc108a84ae4e2566d3466c52bb87a56f141345
- SHA512 2de9126b002ca25686083400faff3c37feab9af568d2e84bb1ca2f8ee2993e9ce9f7416593bb88d9b629012b7591340113541c1320068e300973d2184a84b508
- SSDEEP 196608:fnV1zWZSFD+oEQmAK3HFYUdt45FLOyomFHKnP:fV1uSh9EQm3FYw45F
- TLSH
  T12EA63B03BF5829E4EA456D3001B64B0F939AFD453A366B8F1B09BA1D9FF73C12E41586
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery arktunnel loader proxy tunnel persistence ransomware
- Detects ArkTunnel WebSocket proxy implant
- Family: ArkTunnel
  ArkTunnel is a Windows proxy implant that tunnels connections over a WebSocket C2, written in C.
  proxy tunnel loader arktunnel
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Detects ArkTunnel WebSocket proxy implant

Family: ArkTunnel

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2