Extracted

• • Target

    Client.exe

  • Size

    157KB

  • MD5

    c4d6588bee90ee0c7dd9b674199b0302

  • SHA1

    a3b5f94a66b3198046fec3dd72c0399b6767e5d3

  • SHA256

    f902c427484c65c3bcd1543072e4c53da376a7ba6151fb6d1ccd990bb7a94be2

  • SHA512

    24b7ccf87ec5cc5e3af783a6500b1de4f8a381f31e0baf96f7755cca2a92afee310bcfb3c3bf8b7c033f4161f9b53bbcbd605ee281861e3cd59727870e795a8f

  • SSDEEP

    3072:+bR3+0O5VbFHexuiCrK0ovzNC0Fie+5cVjvn+sZCh8/QbHb68Y:+bRu0OLoxuiCNovpke+cvnOaQ68

  Score

  10^/10

  arrowratclientpersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies WinLogon for persistence

    persistence

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1