arktunnel | wscl[.]exe

Resubmissions

11/11/2026, 03:46

261111-eb56kadw7k10

11/11/2026, 03:41

261111-d9aa4sdw5q10

Sharing

Copy URL Twitter E-mail

General

Target
wscl.exe
Size 239KB
Sample261111-eb56kadw7k
SHA256 e8ef6d859757883c9fc71bd59dffd52fc8ed16c4358bbe6c4338b47ca4f3ef30
MD5 6893076f88a115f3a3f4340b51cb5012
SHA1 148f02e0b45d5a5f0ca66f94836c391d1a4a6759
SHA512 a5b85054b574e5231f20daaa3d7c25b0d605ada09aa5b0bc606498b0cc013f63a724290f1c2617c6a39bcac93399f8f07be13cbd549be482cf2f35412b2bd74e
SSDEEP 3072:hRW2kqlpSUk/Hgt7a0RzSDFpPgsU+FanChkG/qo8kR4T6r:pLCU0Hgt7VRzSDFBgV+AChkG/qovR
TLSH
T15734E639274600ECC4460175211AB239CEE3F5E0C61A8AA782BB5D5CFB2F7F6452776B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

proxy tunnel loader arktunnel

Malware Config

Signatures

Family: ArkTunnel
ArkTunnel is a Windows proxy implant that tunnels connections over a WebSocket C2, written in C.
proxy tunnel loader arktunnel

Detects ArkTunnel WebSocket proxy implant 1 IoCs

resource	yara_rule
sample	family_arktunnel

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wscl.exe

File Explorer

wscl.exe

.exe 239KB

wscl.exe

IMPHASH b6fdf7912f3defc51c3d49ebc6b794ac
SHA256 e8ef6d859757883c9fc71bd59dffd52fc8ed16c4358bbe6c4338b47ca4f3ef30
MD5 6893076f88a115f3a3f4340b51cb5012
SHA1 148f02e0b45d5a5f0ca66f94836c391d1a4a6759
SHA512 a5b85054b574e5231f20daaa3d7c25b0d605ada09aa5b0bc606498b0cc013f63a724290f1c2617c6a39bcac93399f8f07be13cbd549be482cf2f35412b2bd74e
SSDEEP 3072:hRW2kqlpSUk/Hgt7a0RzSDFpPgsU+FanChkG/qo8kR4T6r:pLCU0Hgt7VRzSDFBgV+AChkG/qovR
TLSH
T15734E639274600ECC4460175211AB239CEE3F5E0C61A8AA782BB5D5CFB2F7F6452776B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects ArkTunnel WebSocket proxy implant
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

WSAGetLastError WSAIoctl WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt htonl htons inet_ntop inet_pton ioctlsocket listen ntohl ntohs recv recvfrom send sendto socket

iphlpapi

GetAdaptersAddresses GetAdaptersInfo GetBestRoute2

shlwapi

PathQuoteSpacesW

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AreFileApisANSI CloseHandle CopyFileA CreateFileA CreateIoCompletionPort CreateProcessA CreateThread DeleteCriticalSection DeleteFileA EnterCriticalSection FindClose FindFirstFileA FindNextFileA FormatMessageA GetComputerNameA GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceExA GetFileAttributesA GetHandleInformation GetLastError GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetQueuedCompletionStatusEx GetStartupInfoA GetSystemInfo GetSystemTimeAsFileTime GetTickCount64 GetTickCount GetTimeZoneInformation GetVersionExA GlobalMemoryStatusEx InitOnceExecuteOnce InitializeCriticalSection InitializeSRWLock IsDBCSLeadByte IsDBCSLeadByteEx LeaveCriticalSection LocalFree MoveFileA MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive ReleaseSRWLockShared SetCurrentDirectoryA SetEnvironmentVariableA SetFileCompletionNotificationModes SetLastError SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile

advapi32

ChangeServiceConfig2W CloseServiceHandle CreateServiceW DeleteService LookupAccountNameA OpenSCManagerW OpenServiceW QueryServiceStatus RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW StartServiceW

msvcrt

__lc_codepage __getmainargs __p___argc __p___argv __p___initenv __p___mb_cur_max __p__acmdln __p__commode __p__fmode __p__iob __set_app_type __setusermatherr _amsg_exit _cexit atexit _errno _initterm _lock _mkdir _stati64 _stricmp _unlock abort atoi calloc _close exit fclose fopen fprintf fputc free getc isdigit isleadbyte islower isspace isupper isxdigit localeconv localtime malloc mbstowcs memchr memcpy memmove memset mktime _open perror rand _read realloc signal _spawnl srand strcmp strcpy strerror strftime strlen strncmp strrchr strtol strtoul time tmpnam tolower ungetc vfprintf wcscat wcslen _write

Name

.text

Size

109KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

wscl.exe

ws2_32

iphlpapi

shlwapi

kernel32

advapi32

msvcrt

generic