MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ad5cab14a21c9e0876221f78e9061ca3c2f8712f09c4a49699575de7722e0b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0ad5cab14a21c9e0876221f78e9061ca3c2f8712f09c4a49699575de7722e0b3
SHA3-384 hash:	a3a9f6e9260c10e435a5eef892084f477fde1b881dbdcfd7ec4dab735ae8785d336f2f5968ce12608725f6b10608e76d
SHA1 hash:	0b7927d947f043d8f165a9c28da258e80df1df2b
MD5 hash:	ea5bb057a8fb3ee816667dcf2297f21a
humanhash:	undress-massachusetts-utah-fruit
File name:	payload.ps1
Download:	download sample
Signature	ArrowRAT Alert Create hunting rule
File size:	589 bytes
First seen:	2025-06-12 22:10:51 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	12:nMAY6v2XtkLWj0xR0g9oG4Bu97RuOy0/TooOTteFOXw4LGaNq6PO:v9cjES6qTtLVVNqmO
TLSH	T1A9F0783D8691E4D4A29670E40628250720AA5A17A7754F20FC130A239F2865E8F1A04C
Magika	powershell
Reporter	smica83
Tags:	ArrowRAT ps1 psedrfjygyugyufyt-duckdns-org

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

166

Origin country :

HU

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Other.Malware-gen.23582.18741.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=684b509e8bd5d68a12e850dd

Tags:

obfuscate xtreme shell

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-vm dropper fingerprint obfuscated packed packed powershell

Link:

https://www.filescan.io/uploads/684b5094fd02ed5e05a768e0/reports/2f0c909e-ccb4-4ec8-ae3d-4b153a09cc53/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/0ad5cab14a21c9e0876221f78e9061ca3c2f8712f09c4a49699575de7722e0b3

Joe Sandbox ArrowRAT

Result

Threat name:

ArrowRAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1713703

Signature

.NET source code contains potential unpacker

AI detected malicious Powershell script

Allocates memory in foreign processes

Antivirus detection for dropped file

C2 URLs / IPs found in malware configuration

Creates processes via WMI

Detected unpacking (changes PE section rights)

Drops PE files with benign system names

Encrypted powershell cmdline option found

Found malware configuration

Hides threads from debuggers

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

PE file contains section with special chars

Powershell drops PE file

Query firmware table information (likely to detect VMs)

Sigma detected: Explorer NOUACCHECK Flag

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: Suspicious Program Names

Sigma detected: System File Execution Location Anomaly

Suricata IDS alerts for network traffic

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal browser information (history, passwords, etc)

Uses dynamic DNS services

Writes to foreign memory regions

Yara detected ArrowRAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

78%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/0ad5cab14a21c9e0876221f78e9061ca3c2f8712f09c4a49699575de7722e0b3

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0ad5cab14a21c9e0876221f78e9061ca3c2f8712f09c4a49699575de7722e0b3/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-06-12 05:31:22 UTC

File Type:

Text

AV detection:

4 of 37 (10.81%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=blk4vmkkehe6bb3ceh3y5edbzi6c7bys6coeusljsv2545zc4czq._file

Hatching Triage arrowrat

Result

Malware family:

arrowrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:arrowrat botnet:og defense_evasion discovery execution persistence rat themida trojan

Link:

https://tria.ge/reports/250612-1363tszkw6/

Behaviour

Checks SCSI registry key(s)

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Checks whether UAC is enabled

Enumerates connected drives

Checks BIOS information in registry

Executes dropped EXE

Themida packer

Blocklisted process makes network request

Boot or Logon Autostart Execution: Active Setup

Downloads MZ/PE file

Identifies VirtualBox via ACPI registry values (likely anti-VM)

ArrowRat

Arrowrat family

Malware Config

C2 Extraction:

psedrfjygyugyufyt.duckdns.org:1337

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0ad5cab14a21c9e0876221f78e9061ca3c2f8712f09c4a49699575de7722e0b3