Extracted

• • Target

    wininfo64/lib32.exe

  • Size

    2.2MB

  • MD5

    286de0123129cb1bdb0533301f435746

  • SHA1

    28887e5a7c28661db7b3d4da3612bafd05604813

  • SHA256

    a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71

  • SHA512

    07da8387eeffada23d39eed1390972e37031ea72a2f8a046027ac160f8ecef81ba3011698dac5fafc5114fe688796b1bc7c4df8a283dc1e23f76f0a2faf0b0bc

  • SSDEEP

    49152:IhgaZCojYG3CmQYbfHxDJ6aiyc7jntoe:IhggwdY7d0tV

  Score

  10^/10

  persistencearrowratclientrat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2