Extracted

• • Target

    bJyy.exe

  • Size

    138KB

  • MD5

    bdc72c4851b8543f9f57215f1a3fc336

  • SHA1

    b04f8b232040200d68a75400c5e160d0f61387f7

  • SHA256

    59a734c5ae920f5791ace8728981fffe7c9f9270fe26c27c9482dde038dd398c

  • SHA512

    884be565c02616d79feea31aaa2d13926e9fe530ed656a31595d2f295c346867cf4f4c313350b695d3f8b30e56c625995e360e50820bccc605e915ab3cd68599

  • SSDEEP

    3072:6bvu5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/Y/:6bvqS7BqjjYHdrqkL/

  Score

  10^/10

  arrowrat0xu9g7persistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2