Extracted

• • Target

    ClientH.exe

  • Size

    90KB

  • MD5

    b296864bb2a6846e9b1a59b6e613f7b3

  • SHA1

    529c91595ea7b43ca93c1ad55d7f445841e9f536

  • SHA256

    4ce0eb37a2076db86260f2dbf67dbc34c5e5c79e2fa7895458b5113ea308a2ba

  • SHA512

    77a16f9c3e5b6a983f24618cdcfd65d8dedef2995c3f9399f4c73b11b1b4b0ed8927c69aed3ceda9c4e7151a46263dc085a17fbdaf3ae6a8de691551708fcd7e

  • SSDEEP

    1536:tbRiQM/57SK3bUzZdQ1iIMvnZlbLxjV3AGq5gWlocT1wzySsd9NJ33v:tbR457SKsstcnZTJQDgWPaySsdH5/

  Score

  10^/10

  arrowratvenomhvncpersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies WinLogon for persistence

    persistence

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2