Extracted

• • Target

    Emiditor.exe

  • Size

    8.1MB

  • MD5

    e08805d6085d6402dcaeb253e4375a09

  • SHA1

    2c79a1203c135aa1a7d5fbed566c94983278b40c

  • SHA256

    b559413c43d76b67e8b068c842a0a615b04d6d687be860e18da1adc43dfe5b5e

  • SHA512

    517d723f46c11a10eb303d655ffca77b1bc3f863450208e659cfea70276f15a7d921d52c04597d035faebb7278e66ff55bbb45b451568f11bc176650bd149db9

  • SSDEEP

    98304:iFBz9bmxmtOfP7TI/OKIdSOwSmGrjvvLYq5dkcDNckgHDJHZt:qBzQxmtOfzsWKgwS1jvvH5uFHn

  Score

  10^/10

  evasionthemidatrojanarrowratclientpersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Modifies Installed Components in the registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2