MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54a0a1cf6b5fb30614ff4a2a7757cadf23fa539b4a352137dfc3292c6ceffa24. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArrowRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 54a0a1cf6b5fb30614ff4a2a7757cadf23fa539b4a352137dfc3292c6ceffa24
SHA3-384 hash: 1e4a03d8db86ef895f463596ac7a22ecc28bf67ac593be9584722c2d9dca9a85ad59847871bee423f87621dc39e8f718
SHA1 hash: 1de09d6a5f44169c6c0fe0290dbaca04d13789cc
MD5 hash: 8fa43d91b2fbf126d65bdb8520b57f79
humanhash: bulldog-sad-leopard-fillet
File name:8396_1648147480_5739.exe
Download: download sample
Signature ArrowRAT
Create hunting rule
File size:369'664 bytes
First seen:2022-03-25 07:28:18 UTC
Last seen:2024-07-24 14:27:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:5bRq0OWdltyB7dWY0J6ddKwpgouYj8IbHCLb7tkm+RsMRBvc:m0OEltc7dyEv97jYfRk1mMRB
Threatray 14 similar samples on MalwareBazaar
TLSH T11B74421C75AE101AE0BEEFF407D22A52CF7ABF139517AA4C28D1054227B3784BE4D5E6
Reporter JAMESWT_WT
Tags:ArrowRAT exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
242
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DLAgent10
Create hunting rule
Link:
https://www.capesandbox.com/analysis/257571/
Detection(s):
Win.Packed.Adwarex-9851111-0
Create hunting rule

Win.Packed.Bulz-9891112-0
Create hunting rule

Win.Packed.Injectorx-9916498-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Creating a file
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% subdirectories
Creating a window
Forced system process termination
Creating a file in the %temp% directory
Enabling the 'hidden' option for files in the %temp% directory
Reading critical registry keys
Using the Windows Management Instrumentation requests
DNS request
Creating a file in the %AppData% directory
Sending a custom TCP request
Setting a global event handler for the keyboard
Forced shutdown of a system process
Stealing user critical data
Unauthorized injection to a system process
Enabling autorun by creating a file
Enabling autorun
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
cmd.exe control.exe keylogger obfuscated packed packed replace.exe
Link:
https://www.filescan.io/uploads/623d6f1fa19c6494128c428e/reports/57b14f95-cc9b-4db7-ae39-17abc02afcdd/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3a216480-9431-4fa3-8b02-2de54b5514ad
Result
Threat name:
ArrowRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/964337
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code contains very large strings
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Contains functionality to log keystrokes (.Net Source)
Creates an undocumented autostart registry key
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Uses known network protocols on non-standard ports
Writes to foreign memory regions
Yara detected ArrowRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/54a0a1cf6b5fb30614ff4a2a7757cadf23fa539b4a352137dfc3292c6ceffa24/
Threat name:
Win32.Trojan.PandoraBlade
Create hunting rule
Status:
Malicious
First seen:
2022-03-25 06:54:43 UTC
File Type:
PE (.Net Exe)
Extracted files:
18
AV detection:
14 of 42 (33.33%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
03b91c5f764f0b39b7b0168d26f82354ee7a5ca80004c4534c7d3f0cead86650
ArrowRAT
2049eb0f0d01c273b63f1c660f39258ba4119eed14ed3a817d7073adc4014254
ArrowRAT
2fb8100d4fb1ee22837aec10889c4b0303434e50944b96a390164e449eb62dee
ArrowRAT
3dbd1065734c9b3e603bc2a81dbadb77beeb54c6a918a6a4ae0687659ac3c0fb
ArrowRAT
4c4d844ace41156600bf0c2ab9df287538002abf30d0ba3f50836b2e49f5e0a5
ArrowRAT
6aa5078347357a441ef4427f92696b1d87bca4602c34ce794dbb051463e137f1
ArrowRAT
81aa94f40aa5e393e15b0fefcd9bad6afc9942439c7331abbe4c9f85c648e35c
ArrowRAT
8a3d555c8d1019b6d42721a2eea770d2101458fd70b208f6767db2eeb1cd44bc
ArrowRAT
a363be63c8e71b4a27ca1f8caae32b90f1e3920fee56ab82c80fccedbea5e3cf
ArrowRAT
d1a5b0c2921ff9bd8f61d5681eabab1fa054c4e19521a2ae317802b672c8e060
ArrowRAT
+ 4 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence
Link:
https://tria.ge/reports/220325-ja9vksbge3/
Behaviour
Checks SCSI registry key(s)
Enumerates system info in registry
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Enumerates connected drives
Modifies Installed Components in the registry
Modifies WinLogon for persistence
Unpacked files
SH256 hash:
fe989b982aa10bd94a4fa4272f33d987c136f05471e2fd4a7e7de8b43d4b6a9f
MD5 hash:
92c75af7f7cc3cadc15e7d7352e86e38
SHA1 hash:
6fd5268b07bb6c78266dcba66620d754a1cead2f
Link:
https://www.unpac.me/results/f710519e-cecf-4687-8bda-999c85c1679d/
SH256 hash:
e245c4a7d41e095b5c5136a89e698bd11e452594d864e250607cff2b2efadbab
MD5 hash:
6c991f5490cd23d8df31d89864395b21
SHA1 hash:
a6e3fde5d6f72fce36c5a8955a6025d92efb4356
Link:
https://www.unpac.me/results/f710519e-cecf-4687-8bda-999c85c1679d/
SH256 hash:
c9e46c6376806b484a9ca767591c363961b27643737b2450f27e0ec2d0ad7fa9
MD5 hash:
df820f92dc70636f0a554d927b85e59f
SHA1 hash:
4a103fe930bbe9c2362c1b3a604c0d6393b8727f
Link:
https://www.unpac.me/results/f710519e-cecf-4687-8bda-999c85c1679d/
SH256 hash:
54a0a1cf6b5fb30614ff4a2a7757cadf23fa539b4a352137dfc3292c6ceffa24
MD5 hash:
8fa43d91b2fbf126d65bdb8520b57f79
SHA1 hash:
1de09d6a5f44169c6c0fe0290dbaca04d13789cc
Link:
https://www.unpac.me/results/f710519e-cecf-4687-8bda-999c85c1679d/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/54a0a1cf6b5f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/54a0a1cf6b5fb30614ff4a2a7757cadf23fa539b4a352137dfc3292c6ceffa24

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
Create hunting rule
Author:ditekSHen
Description:Detects executables containing URLs to raw contents of a Github gist
Rule name:MALWARE_Win_DLAgent10
Create hunting rule
Author:ditekSHen
Description:Detects known downloader agent
Rule name:MAL_Lokibot_Stealer
Create hunting rule
Description:Detects Lokibot Stealer Variants
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/257571/

Comments