Extracted

• • Target

    111.exe

  • Size

    1.2MB

  • MD5

    e27749108c213382a99148b1e8db141d

  • SHA1

    342fff490afc93461090c3d096092de7799cedb7

  • SHA256

    d65bbb5f627ce7367a8f7e391a03b819f800f6606908e9423c791844ff129563

  • SHA512

    e8f1cf8e69435c3bd0265044d3fa03ae2b3f8ffac5ef1b4ffadc2db7b0cb38c804eaed12b9af90936db785fecb2039b77f869e7fa96f02f9aebacca2aecc7bb4

  • SSDEEP

    24576:yJTlBHCmG+3FLG2ffq44sR7auN9pEYXwhyYM/D/WSLkoAhP9FPZ1aKdw:6lVCgLJfqp47awp0h1yLDLJIlFWgw

  Score

  10^/10

  arrowratclientpersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies WinLogon for persistence

    persistence

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1