MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e37964ebdb10d9e06d3aa47b5ca1500571e13f582d50add487110c7abb26a76c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArrowRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e37964ebdb10d9e06d3aa47b5ca1500571e13f582d50add487110c7abb26a76c
SHA3-384 hash: 3ea0fa8b713b9ad29da1cbad8ac4455241bcff7616da1728f942476dc787725dd1645a9b2918a9f2a344da95d6b3401d
SHA1 hash: ae62b6a2729f55c70e682247b1eafe09c4e03890
MD5 hash: f24c263ecf54962af2a2ae5e7f5b139e
humanhash: uniform-cardinal-whiskey-queen
File name:x2xFapxhdTcU.exe
Download: download sample
Signature ArrowRAT
Create hunting rule
File size:141'824 bytes
First seen:2023-03-05 23:28:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 3072:+bvB5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/YI:+bvPS7BqjjYHdrqkL/
Threatray 15 similar samples on MalwareBazaar
TLSH T1BED35B2439FA5019F273EF795FE474969A6FB6733B07A45E0091038A0723A81DED163E
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter pmelson
Tags:ArrowRAT exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
229
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
x2xFapxhdTcU.exe
Verdict:
Malicious activity
Analysis date:
2023-03-05 23:29:49 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/cddbf569-4f96-4a48-8537-fc6b61cbf6a7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DLAgent10 Downloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/371746/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Win.Packed.Injectorx-9916498-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a process with a hidden window
Creating a file
Sending a custom TCP request
Unauthorized injection to a system process
Enabling autorun
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/640525bebfec0852a68f7bed/reports/ff16589f-a963-4028-bde8-fb2e4b7db56b/overview
Verdict:
Malicious
Labled as:
IL:Trojan.MSILZilla
Link:
https://www.hybrid-analysis.com/sample/e37964ebdb10d9e06d3aa47b5ca1500571e13f582d50add487110c7abb26a76c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Evilnum
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/29f945f2-fc61-4ab7-bbf8-f7ec27263dfd
Result
Threat name:
ArrowRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1187453
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates an undocumented autostart registry key
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected ArrowRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e37964ebdb10d9e06d3aa47b5ca1500571e13f582d50add487110c7abb26a76c/
Threat name:
ByteCode-MSIL.Trojan.Zilla
Create hunting rule
Status:
Malicious
First seen:
2023-03-05 23:51:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
23 of 25 (92.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4n4wj263cdm6a3j2ur5vzikqavy6cp2yfvik3vehceghvozgu5wa._file
Verdict:
malicious
Similar samples:
150c06bc4cba9064302fb96f2b3565f433b43847b6d59448ce15b9024e6c9b0a
ArrowRAT
2fb8100d4fb1ee22837aec10889c4b0303434e50944b96a390164e449eb62dee
ArrowRAT
3dbd1065734c9b3e603bc2a81dbadb77beeb54c6a918a6a4ae0687659ac3c0fb
ArrowRAT
4c4d844ace41156600bf0c2ab9df287538002abf30d0ba3f50836b2e49f5e0a5
ArrowRAT
5d573461fbe87a4441a12b5b61a3b74019aa21a784f9cf4410e1da100a55c792
ArrowRAT
8a3d555c8d1019b6d42721a2eea770d2101458fd70b208f6767db2eeb1cd44bc
ArrowRAT
b3d1d312b9fb579640acad50a9591b7876c75e9dbf9df4d9f9a33575ed659173
ArrowRAT
d1a5b0c2921ff9bd8f61d5681eabab1fa054c4e19521a2ae317802b672c8e060
ArrowRAT
d3371af2067d4ab057a9ddd352f439dfbe19d11e8012a8a7586d7402be33fc39
ArrowRAT
fb48bb91678c696679b72b046aa24ecddb98c4ccf65d068393cdb722cdba8caa
ArrowRAT
+ 5 additional samples on MalwareBazaar
Result
Malware family:
arrowrat
Create hunting rule
Score:
  10/10
Tags:
family:arrowrat botnet:jb0qwl persistence rat
Link:
https://tria.ge/reports/230305-3gjfrahc7z/
Behaviour
Checks SCSI registry key(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Suspicious use of SetThreadContext
Enumerates connected drives
Modifies Installed Components in the registry
ArrowRat
Modifies WinLogon for persistence
Malware Config
C2 Extraction:
antgobec.duckdns.org:1338
Unpacked files
SH256 hash:
37a1ec5bad66b1f7e842c99b6b2438fca939f6bf20be20bdde4b7963cd90c926
MD5 hash:
c8308b4dbdbe2e8d0ed8de86360d08f0
SHA1 hash:
7a9d65846e9d171d368fd20ebf6de6327b76f414
Link:
https://www.unpac.me/results/e47cdd80-5cb0-4474-97ce-58121faf22da/
Parent samples :
63ab8bad7e72c1c4044743b0de2efd791a4f9bf12e85b2bd973b7309d50eafc8
b766c8001cc928c65188a80a149d8eb11c59178b68cee4437659e67d2f02c402
6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090
98c70efff4675dd2ef3f9a90afb155c4fdbee2aa1f0f2e1641f9c0b8f432407a
SH256 hash:
e37964ebdb10d9e06d3aa47b5ca1500571e13f582d50add487110c7abb26a76c
MD5 hash:
f24c263ecf54962af2a2ae5e7f5b139e
SHA1 hash:
ae62b6a2729f55c70e682247b1eafe09c4e03890
Link:
https://www.unpac.me/results/e47cdd80-5cb0-4474-97ce-58121faf22da/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e37964ebdb10/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.38
Link:
https://yomi.yoroi.company/submissions/e37964ebdb10d9e06d3aa47b5ca1500571e13f582d50add487110c7abb26a76c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
Create hunting rule
Author:ditekSHen
Description:Detects executables containing URLs to raw contents of a Github gist
Rule name:MALWARE_Win_DLAgent10
Create hunting rule
Author:ditekSHen
Description:Detects known downloader agent
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArrowRAT

Executable exe e37964ebdb10d9e06d3aa47b5ca1500571e13f582d50add487110c7abb26a76c

(this sample)

  
Link
https://www.virustotal.com/gui/file/e37964ebdb10d9e06d3aa47b5ca1500571e13f582d50add487110c7abb26a76c/detection
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/371746/

Comments