MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3dbd1065734c9b3e603bc2a81dbadb77beeb54c6a918a6a4ae0687659ac3c0fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArrowRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3dbd1065734c9b3e603bc2a81dbadb77beeb54c6a918a6a4ae0687659ac3c0fb
SHA3-384 hash: 87238615e311a23e4838546187677000d299480d566470beb588e676ec8dfde945d2839e486e8bcef0625fcc15143f22
SHA1 hash: 99983e91bc7511fcb650c31c26a33b581e242913
MD5 hash: 7da02064216481c00e88ca35db73c247
humanhash: kansas-edward-lactose-cola
File name:7da02064216481c00e88ca35db73c247
Download: download sample
Signature ArrowRAT
Create hunting rule
File size:141'824 bytes
First seen:2022-01-13 12:22:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 3072:LbvJ5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/YK:Lbv3S7BqjjYHdrqkL/
Threatray 7 similar samples on MalwareBazaar
TLSH T1AED35B2439FA5019F273EF795FE474969A6FB6733B07A45E0091038A0723A41DED163E
Reporter zbetcheckin
Tags:32 ArrowRAT exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
221
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7da02064216481c00e88ca35db73c247
Verdict:
Malicious activity
Analysis date:
2022-01-13 12:26:40 UTC
Tags:
stealer
Link:
https://app.any.run/tasks/75bf883c-050b-41d4-960c-289cd2a8c096

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DLAgent10
Create hunting rule
Link:
https://www.capesandbox.com/analysis/218991/
Detection(s):
Win.Packed.Injectorx-9916498-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a process with a hidden window
Creating a file
Searching for the window
Сreating synchronization primitives
Creating a window
Forced system process termination
Creating a process from a recently created file
Creating a file in the %temp% directory
Enabling the 'hidden' option for files in the %temp% directory
Reading critical registry keys
Using the Windows Management Instrumentation requests
DNS request
Forced shutdown of a system process
Enabling autorun with the shell\open\command registry branches
Stealing user critical data
Unauthorized injection to a system process
Enabling autorun
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61e019ab1883c5ba4ec7b075/reports/010bc6a9-a53f-460b-bcf9-593da2deec0e/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b83bf06e-d701-43ef-967c-811b14bae2b2
Result
Threat name:
ArrowRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/920036
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Bypasses PowerShell execution policy
Creates an undocumented autostart registry key
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Change PowerShell Policies to a Unsecure Level
Sigma detected: Powershell Defender Exclusion
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Uses known network protocols on non-standard ports
Writes to foreign memory regions
Yara detected ArrowRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 552514 Sample: 7Hoil306ku Startdate: 13/01/2022 Architecture: WINDOWS Score: 100 36 Antivirus detection for dropped file 2->36 38 Antivirus / Scanner detection for submitted sample 2->38 40 Multi AV Scanner detection for dropped file 2->40 42 9 other signatures 2->42 8 7Hoil306ku.exe 3 4 2->8         started        process3 file4 28 C:\Users\user\AppData\Local\...\4RUF2A.exe, PE32 8->28 dropped 30 C:\Users\user\AppData\...\7Hoil306ku.exe.log, ASCII 8->30 dropped 44 Creates an undocumented autostart registry key 8->44 46 Writes to foreign memory regions 8->46 48 Allocates memory in foreign processes 8->48 50 Injects a PE file into a foreign processes 8->50 12 ComputerDefaults.exe 12 8->12         started        15 cvtres.exe 15 5 8->15         started        18 explorer.exe 1 131 8->18         started        20 cvtres.exe 8->20         started        signatures5 process6 dnsIp7 52 Suspicious powershell command line found 12->52 54 Bypasses PowerShell execution policy 12->54 56 Adds a directory exclusion to Windows Defender 12->56 22 powershell.exe 25 12->22         started        32 51.178.165.162, 1338, 49797, 49804 OVHFR France 15->32 34 51.254.27.112, 1337, 49806 OVHFR France 15->34 58 Tries to harvest and steal browser information (history, passwords, etc) 15->58 24 conhost.exe 15->24         started        signatures8 process9 process10 26 conhost.exe 22->26         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3dbd1065734c9b3e603bc2a81dbadb77beeb54c6a918a6a4ae0687659ac3c0fb/
Threat name:
Win32.Trojan.StealInj
Create hunting rule
Status:
Malicious
First seen:
2022-01-05 17:09:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
38 of 43 (88.37%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
309f224bfc7c045033d627fbe2df400042a21a16914b600eb20498fb6ba9d8b8
ArrowRAT
49d0b1b5280ab2b29dfafbdeedf0b360d7953bafcfcbacebddf7b50a321cb6d6
ArrowRAT
694c513735b327961745d7e6da7f10c982b532fa4ce3f52b817dfdd2d7ec2e21
ArrowRAT
aa5b1bd2e155babe91152f629e7afebfb5ee805a53f01d50394d7f6489d04cff
ArrowRAT
d1a5b0c2921ff9bd8f61d5681eabab1fa054c4e19521a2ae317802b672c8e060
ArrowRAT
d2f7e7285b03e6374aac8c497ed7f6048ec7917efb1dc17ba6adc58af2a5dc55
ArrowRAT
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence
Link:
https://tria.ge/reports/220113-pkf8xaaad7/
Behaviour
Checks SCSI registry key(s)
Enumerates system info in registry
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Enumerates connected drives
Modifies Installed Components in the registry
Modifies WinLogon for persistence
Unpacked files
SH256 hash:
37a1ec5bad66b1f7e842c99b6b2438fca939f6bf20be20bdde4b7963cd90c926
MD5 hash:
c8308b4dbdbe2e8d0ed8de86360d08f0
SHA1 hash:
7a9d65846e9d171d368fd20ebf6de6327b76f414
Link:
https://www.unpac.me/results/569297b5-1791-47b9-9514-c747875fe3ae/
Parent samples :
63ab8bad7e72c1c4044743b0de2efd791a4f9bf12e85b2bd973b7309d50eafc8
b766c8001cc928c65188a80a149d8eb11c59178b68cee4437659e67d2f02c402
6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090
98c70efff4675dd2ef3f9a90afb155c4fdbee2aa1f0f2e1641f9c0b8f432407a
SH256 hash:
3dbd1065734c9b3e603bc2a81dbadb77beeb54c6a918a6a4ae0687659ac3c0fb
MD5 hash:
7da02064216481c00e88ca35db73c247
SHA1 hash:
99983e91bc7511fcb650c31c26a33b581e242913
Link:
https://www.unpac.me/results/569297b5-1791-47b9-9514-c747875fe3ae/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.53
Link:
https://yomi.yoroi.company/submissions/3dbd1065734c9b3e603bc2a81dbadb77beeb54c6a918a6a4ae0687659ac3c0fb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
Create hunting rule
Author:ditekSHen
Description:Detects executables containing URLs to raw contents of a Github gist
Rule name:MALWARE_Win_DLAgent10
Create hunting rule
Author:ditekSHen
Description:Detects known downloader agent
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArrowRAT

Executable exe 3dbd1065734c9b3e603bc2a81dbadb77beeb54c6a918a6a4ae0687659ac3c0fb

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1973785/
Cape
Cape
https://www.capesandbox.com/analysis/218991/
  
URLhaus
https://urlhaus.abuse.ch/url/1975769/
  
URLhaus
https://urlhaus.abuse.ch/url/1975852/

Comments


Avatar
zbet commented on 2022-01-13 12:22:25 UTC

url : hxxp://tstzlx6fem2rrjd5blekndbj6nwvl5qff7hewzjxaqm2wxm3mk25qcyd.onion.ws/less.exe