MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21994949d4df4bdbe5834379c2f7f023c8fa20eb1bdd7a5756f651fe2ff91ae7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ArrowRAT

Vendor detections: 16

Intelligence 16 IOCs YARA 18 File information Comments

SHA256 hash:	21994949d4df4bdbe5834379c2f7f023c8fa20eb1bdd7a5756f651fe2ff91ae7
SHA3-384 hash:	8cb73dc91bd348244fad7f48947eb4ac52a5ba17ede478d2323d0f38dc3432d07aa50a0bdeb38d4d71a811f8145f52a1
SHA1 hash:	6e13021078cbc623f0aa28f3ff671676e4871a39
MD5 hash:	69f673730adc1da213f8cce316c2d073
humanhash:	cat-robert-batman-ceiling
File name:	1.exe
Download:	download sample
Signature	ArrowRAT Create hunting rule
File size:	3'605'504 bytes
First seen:	2025-06-12 22:17:26 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4328f7206db519cd4e82283211d98e83 (533 x RedLineStealer, 18 x Arechclient2, 15 x DCRat)
ssdeep	98304:SwbLAPmwkKoVXJbLliE3yZ1sAVEmMSJ6N7FJNmUpdmeI:SwbpwmVZbZfuVENSE/JNmkceI
Threatray	237 similar samples on MalwareBazaar
TLSH	T16FF5333509F64A27C96786F789AEC35EDB7A3B0157C00E4075FF249B14AA5BD3E0A9C0
TrID	27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4504/4/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	smica83
Tags:	ArrowRAT exe psedrfjygyugyufyt-duckdns-org

Intelligence

File Origin

# of uploads :

# of downloads :

595

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

payload.ps1

Verdict:

Malicious activity

Analysis date:

2025-06-12 22:13:18 UTC

Tags:

uac

Link:

https://app.any.run/tasks/9a142373-a39e-4290-8b7a-f3f349fe9d0f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

DLAgent10

Link:

https://www.capesandbox.com/analysis/9227/

Detection(s):

SecuriteInfo.com.Trojan.Inject5.56022.29897.20541.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=684b520607b5e8c1cfe69b9e

Tags:

keylog remo blic

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for analyzing tools

Searching for the window

Launching a process

Сreating synchronization primitives

Creating a process with a hidden window

Creating a window

Forced system process termination

Creating a file in the %temp% directory

Enabling the 'hidden' option for files in the %temp% directory

Reading critical registry keys

DNS request

Using the Windows Management Instrumentation requests

Connection attempt

Creating a file in the %AppData% directory

Sending a custom TCP request

Setting a global event handler for the keyboard

Stealing user critical data

Unauthorized injection to a system process

Enabling autorun by creating a file

Verdict:

Malicious

Labled as:

Zusy.Generic

Link:

https://www.hybrid-analysis.com/sample/21994949d4df4bdbe5834379c2f7f023c8fa20eb1bdd7a5756f651fe2ff91ae7

Malware family:

Icarus Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/734ed2cf-9e71-4ff4-8b80-1e36b555ca30

Result

Threat name:

ArrowRAT

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1713704

Signature

.NET source code contains potential unpacker

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Found malware configuration

Hides threads from debuggers

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: Explorer NOUACCHECK Flag

Sigma detected: Files With System Process Name In Unsuspected Locations

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal browser information (history, passwords, etc)

Uses dynamic DNS services

Writes to foreign memory regions

Yara detected ArrowRAT

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/21994949d4df4bdbe5834379c2f7f023c8fa20eb1bdd7a5756f651fe2ff91ae7

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/21994949d4df4bdbe5834379c2f7f023c8fa20eb1bdd7a5756f651fe2ff91ae7/

Threat name:

Win32.Malware.Heuristic

Status:

Malicious

First seen:

2025-06-12 22:18:53 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

27 of 38 (71.05%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=egmussou35f5xzmdin44f57qepepuihldpoxuv2w6zi74l7zdltq._file

Verdict:

malicious

Label(s):

arrowrat

ArrowRAT

6bacbe921c817ef6fc3d2fa1b8cd100452d5f002bd76ce536632abc633f571ae

ArrowRAT

8bcfd81ccfc02af640a747e29cca4b8eacca82bf4961c808b6cbebe2619d0a55

ArrowRAT

aa48a900d4c757538a9e638a8b90ee46943f0faa65eb0828938e51fe7ee720a7

ArrowRAT

error

ArrowRAT

fa918289433c703e2df9e0094bc05c67fdb2259603ae24a44b02edb0cc7ec62c

ArrowRAT

+ 227 additional samples on MalwareBazaar

Result

Malware family:

arrowrat

Score:

10/10

Tags:

family:arrowrat botnet:og defense_evasion discovery persistence rat themida trojan

Link:

https://tria.ge/reports/250612-17l88aswas/

Behaviour

Checks SCSI registry key(s)

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Checks whether UAC is enabled

Enumerates connected drives

Checks BIOS information in registry

Themida packer

Boot or Logon Autostart Execution: Active Setup

Identifies VirtualBox via ACPI registry values (likely anti-VM)

ArrowRat

Arrowrat family

Malware Config

C2 Extraction:

psedrfjygyugyufyt.duckdns.org:1337

Verdict:

Malicious

Tags:

firebird pandorahvnc rat

YARA:

n/a

Link:

https://app.threat.zone/submission/69343417-feab-41e7-8565-21fed1c59a84

Unpacked files

SH256 hash:

21994949d4df4bdbe5834379c2f7f023c8fa20eb1bdd7a5756f651fe2ff91ae7

MD5 hash:

69f673730adc1da213f8cce316c2d073

SHA1 hash:

6e13021078cbc623f0aa28f3ff671676e4871a39

Link:

https://www.unpac.me/results/c0504540-91d1-4f98-b21f-ee41c4f45f4b/

SH256 hash:

de0aa79373299d38e79f5895530c54d43970c18867212ee171580e5e28dca5eb

MD5 hash:

8c7fb0e684cd7873d2641f301c2d41dd

SHA1 hash:

0a65293bd4af0d865c4d7dabacd49ca978cc063b

Link:

https://www.unpac.me/results/c0504540-91d1-4f98-b21f-ee41c4f45f4b/

SH256 hash:

3f5cf0b84c84516113496e6ed1c782da73288309968083aef9d0a871db1a5c40

MD5 hash:

f9982b044c695d3a307271e00a4e58e3

SHA1 hash:

1e5408891b561e1d98846ecefacc5b771ca8a8e9

Detections:

INDICATOR_EXE_Packed_Themida

MALWARE_Win_ArrowRAT

Link:

https://www.unpac.me/results/c0504540-91d1-4f98-b21f-ee41c4f45f4b/

SH256 hash:

65af41452cb1eb8e98cbd4238ccff79bd619d2453ce2e2eaa31620b0b83077be

MD5 hash:

5bb9bba5beeacaef4c481c6813932490

SHA1 hash:

402574cf96c8d17701944f03e36d9d80ab367907

Detections:

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

MALWARE_Win_DLAgent10

SUSP_NET_Large_Static_Array_In_Small_File_Jan24

Link:

https://www.unpac.me/results/c0504540-91d1-4f98-b21f-ee41c4f45f4b/

Parent samples :

a73f67009d77906b2dfee216b4e7cb940eef13304c22e909b65cd2834e291b1a
040cef4a919bf259e750029187dcfeff8b4b8f18e6a65cb401ee941d7999dd51
083a768ec4dfeec0b5d0e4320979ab0fede45e53aa4971846a6878912664e47a
0a53456ad2ce6a20c459e38a8fb0be2751c7543a0d8a47f52bb48a8b6d24d335
0d765dc413009ddb31ab0685ee4eb1a1dd9e68d415c0f75df36fd08c195bc216
79ec7c271adcd148064e5324c66d8ea9c1eefd81c44bde7c9ca754f4fb9d80b3
21994949d4df4bdbe5834379c2f7f023c8fa20eb1bdd7a5756f651fe2ff91ae7
97e7e5a6f2da89b78b9b4b518a77c69c40dcfe0feda399148921fe3145d36d77
fb7e10845d0ebac00b55f38a29e141c689a33cae3719eefb26fbb572b39aa3a4

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/21994949d4df/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/21994949d4df4bdbe5834379c2f7f023c8fa20eb1bdd7a5756f651fe2ff91ae7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	growtopia Create hunting rule
Author:	Michelle Khalil
Description:	This rule detects unpacked growtopia stealer malware samples.

Rule name:	INDICATOR_EXE_Packed_Themida Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with Themida

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	MALWARE_Win_ArrowRAT Create hunting rule
Author:	ditekSHen
Description:	Detects ArrowRAT

Rule name:	MALWARE_Win_DLAgent10 Create hunting rule
Author:	ditekSHen
Description:	Detects known downloader agent

Rule name:	Multifamily_RAT_Detection Create hunting rule
Author:	Lucas Acha (http://www.lukeacha.com)
Description:	Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Runtime_Broker_Variant_1 Create hunting rule
Author:	Sn0wFr0$t
Description:	Detecting malicious Runtime Broker

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Windows_Generic_Threat_21253888 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

ArrowRAT

ps1 0ad5cab14a21c9e0876221f78e9061ca3c2f8712f09c4a49699575de7722e0b3

ArrowRAT

exe 21994949d4df4bdbe5834379c2f7f023c8fa20eb1bdd7a5756f651fe2ff91ae7

(this sample)

Dropped by

MD5 ea5bb057a8fb3ee816667dcf2297f21a

Dropped by

SHA256 0ad5cab14a21c9e0876221f78e9061ca3c2f8712f09c4a49699575de7722e0b3

Cape

https://www.capesandbox.com/analysis/9227/

URLhaus

https://urlhaus.abuse.ch/url/3561664/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (NX_COMPAT)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample