Extracted

Extracted

• • Target

    d.vbs

  • Size

    816KB

  • MD5

    2af5abb6db76b3f1872d568880aced94

  • SHA1

    1e47fb1ba30452f72db8f71fe8dde5a7ad5c1f2c

  • SHA256

    3da90ba538cd2589d4018e15b760db3c508d6ffbb7032e3a66789a4c9d09c7b2

  • SHA512

    ba2e899b365b637547301e2402f16f686badb3f182456dc9c552d1e25eb5a6ca6fa9d75cfe9e260f6ba0edba608daf7dee516cc58c659b8b4844388b330889d2

  • SSDEEP

    6144:nfBfcfYfBfcfhfKfzfffBfcfYfBfcfhfKfqfBfcfYfBfcfhfKfdfBfcfYfBfcfht:r

  Score

  10^/10

  arrowratfsocitypersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Blocklisted process makes network request

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2