Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    arrow/0caa17db0c1d695ce4e5bc3f3fc7c9c2e7f96e489108e0303b81fa45efcf92bd.bin

  • Size

    138KB

  • MD5

    bb434c347ca1709e54bee1a5d9a5757e

  • SHA1

    844b1f01f53eb6e8f8934880fa7f8994c4245dd4

  • SHA256

    0caa17db0c1d695ce4e5bc3f3fc7c9c2e7f96e489108e0303b81fa45efcf92bd

  • SHA512

    46b87c83ce85d44b152a5921b76f65af19fc93896bc8557b979c72ffdbaef3b21245f1c8aea75a5bd2125bc8df7485f2bcaf98d8b7ee0785c8c1496d08a571be

  • SSDEEP

    3072:PbvG5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/Yt:PbviS7BqjjYHdrqkL/

  Score

  10^/10

  arrowratkrck1rpersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies WinLogon for persistence

    persistence

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    arrow/150c06bc4cba9064302fb96f2b3565f433b43847b6d59448ce15b9024e6c9b0a.bin

  • Size

    138KB

  • MD5

    a771f2894d94322a49b0ce2e14493a3e

  • SHA1

    63cd63601410fe6be499a9102cbbd6c675e72f56

  • SHA256

    150c06bc4cba9064302fb96f2b3565f433b43847b6d59448ce15b9024e6c9b0a

  • SHA512

    ab75a88fbc2a8fd5320fdddb525af9a70c3553fa33b967545d4491a0ecd2e24869caeea49fdd7324d4ed666c42b8f5444c474056dddda0746af135bb97478765

  • SSDEEP

    3072:6bvA5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/Yd:6bv4S7BqjjYHdrqkL/

  Score

  10^/10

  arrowratag35pwpersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies WinLogon for persistence

    persistence

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4

• • Target

    arrow/17a76858f5bba3812b8f429e261ba0e84baf8197fe1f4478aa6c7adc5d8dd6ff.bin

  • Size

    138KB

  • MD5

    fcc0c059b3a4b6f9f865fcde362b9acb

  • SHA1

    23edfe65a519d095ca11f3987bfe6de661953f49

  • SHA256

    17a76858f5bba3812b8f429e261ba0e84baf8197fe1f4478aa6c7adc5d8dd6ff

  • SHA512

    0ebd9972df18c0de58077dceaf0e9618e4e6c004d53775272c8db9613a8db90834e10a255213f55ff492ae489498cc9bdbecf386986cdb1d5a0d2cfe45785b43

  • SSDEEP

    3072:2bvt5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/YO:2bv7S7BqjjYHdrqkL/

  Score

  10^/10

  arrowratil61hbpersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral5behavioral6

• • Target

    arrow/2380ff875da958af3a345764860a8d70761bdc4f9feb20c1b183a83b9cae1b0c.bin

  • Size

    138KB

  • MD5

    e22c97f1931fdec29962ae778c5b44c3

  • SHA1

    7b0587f698a12619a735ce2536ec6a298ac92874

  • SHA256

    2380ff875da958af3a345764860a8d70761bdc4f9feb20c1b183a83b9cae1b0c

  • SHA512

    6f65b90401c650f66e22fb65c176edf73c09ef0bc0a34f7ee761fb984032e975cc3835dcdb22bc3d62c99678ad7a03b0fcbeb8dd679728ce49d035763c49c309

  • SSDEEP

    3072:2bvt5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/Y0:2bv7S7BqjjYHdrqkL/

  Score

  10^/10

  arrowraty905dcpersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral7behavioral8

• • Target

    arrow/2fb8100d4fb1ee22837aec10889c4b0303434e50944b96a390164e449eb62dee.bin

  • Size

    28KB

  • MD5

    6082510f97c65c06f1d21809efa9d040

  • SHA1

    78e65ca4aef33eea338a2972f19679552cb7c701

  • SHA256

    2fb8100d4fb1ee22837aec10889c4b0303434e50944b96a390164e449eb62dee

  • SHA512

    fc56029acc10a16f98d0405d9dca6e33be996a8ae2bc7353c4cac9b5431566cdb675da975740f5cd428ef24f28c3542e2070dd6d29e9b519d55d92a0ea5fc649

  • SSDEEP

    768:heqX/79Z4TCXfVsNuRVbpLchtszwBRUgT6TtQ0nt:hBX/zlsNuRVbWawBKgT6TtQK

  Score

  7^/10

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral10behavioral9

• • Target

    arrow/3dbd1065734c9b3e603bc2a81dbadb77beeb54c6a918a6a4ae0687659ac3c0fb.bin

  • Size

    138KB

  • MD5

    7da02064216481c00e88ca35db73c247

  • SHA1

    99983e91bc7511fcb650c31c26a33b581e242913

  • SHA256

    3dbd1065734c9b3e603bc2a81dbadb77beeb54c6a918a6a4ae0687659ac3c0fb

  • SHA512

    df61e4e5226cf035592ec464b68452507df4178edac853329cda8e0fe06102f8eae65bd9d7a6b68d835e2d7ef4ed3748ccd8bc1ed918eb2a85fb9788e5aafae6

  • SSDEEP

    3072:LbvJ5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/YK:Lbv3S7BqjjYHdrqkL/

  Score

  10^/10

  arrowrat9g7dxwpersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies WinLogon for persistence

    persistence

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral11behavioral12

• • Target

    arrow/4a09a7db3729524b264f61bd57d422714e43167d391eae1df73cad90c2982d07.bin

  • Size

    65KB

  • MD5

    dece5aade19a0a646a41e40fe42deda3

  • SHA1

    1ef25d469b835fcb3f4e1a10d894e0779a297730

  • SHA256

    4a09a7db3729524b264f61bd57d422714e43167d391eae1df73cad90c2982d07

  • SHA512

    8a5bbffe0cad2c85df2b305dcde269ceee70804bde2c26bea0b55e09fd79ce47fffdcfff19e3f21baa1254cde4aa89c9597945b18d666a13f075c45d4a74b3e5

  • SSDEEP

    1536:mnhjtb22D0b82c1rVjB1bbsSxResZf+aswNpqKmY7:mnP22wbg1f1bbsSbxKwWz

  Score

  10^/10

  asyncratarrowrat clientsrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Async RAT payload

    rat
  behavioral13behavioral14

• • Target

    arrow/4c4d844ace41156600bf0c2ab9df287538002abf30d0ba3f50836b2e49f5e0a5.bin

  • Size

    17KB

  • MD5

    e41f3d5033575c4f4cf2acd0d1d0624d

  • SHA1

    18ff7a2ec479855e65ba2a83deeb917abed16ff9

  • SHA256

    4c4d844ace41156600bf0c2ab9df287538002abf30d0ba3f50836b2e49f5e0a5

  • SHA512

    d51e644c8f66735625556d15af240756b72f61f616133b9412b27cacc17fadf42a8ee2113eaa6f544c376bd66464cf177f8ca556d75d532d2d799f5327e2fd29

  • SSDEEP

    384:eBAiyJNFVJU14KU6nX2D+bFQkNubvg+4OXEW46njPHoWWDDDDDDDDDDN:iGFwWp6nnb+/XjDjYDDDDDDDDDDN

  Score

  7^/10

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral15behavioral16

• • Target

    arrow/54a0a1cf6b5fb30614ff4a2a7757cadf23fa539b4a352137dfc3292c6ceffa24.bin

  • Size

    361KB

  • MD5

    8fa43d91b2fbf126d65bdb8520b57f79

  • SHA1

    1de09d6a5f44169c6c0fe0290dbaca04d13789cc

  • SHA256

    54a0a1cf6b5fb30614ff4a2a7757cadf23fa539b4a352137dfc3292c6ceffa24

  • SHA512

    63086eb0f61cbc8f240d332ab09342bf0abc449a2a6d94ba13ce4cfff62832eee7193aa71c3eaa0ea5edb260169c8aba4deade1db5dab0aae0c5d6f3f9dd0bf5

  • SSDEEP

    6144:5bRq0OWdltyB7dWY0J6ddKwpgouYj8IbHCLb7tkm+RsMRBvc:m0OEltc7dyEv97jYfRk1mMRB

  Score

  10^/10

  arrowratcompanypersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies WinLogon for persistence

    persistence

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral17behavioral18

• • Target

    arrow/59a734c5ae920f5791ace8728981fffe7c9f9270fe26c27c9482dde038dd398c.bin

  • Size

    138KB

  • MD5

    bdc72c4851b8543f9f57215f1a3fc336

  • SHA1

    b04f8b232040200d68a75400c5e160d0f61387f7

  • SHA256

    59a734c5ae920f5791ace8728981fffe7c9f9270fe26c27c9482dde038dd398c

  • SHA512

    884be565c02616d79feea31aaa2d13926e9fe530ed656a31595d2f295c346867cf4f4c313350b695d3f8b30e56c625995e360e50820bccc605e915ab3cd68599

  • SSDEEP

    3072:6bvu5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/Y/:6bvqS7BqjjYHdrqkL/

  Score

  10^/10

  arrowrat0xu9g7persistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral19behavioral20

• • Target

    arrow/5a45e4a32a4f2081b33dee2ab94eb3ebb4afafe0bd8f5b76e93dfe975c4a607c.bin

  • Size

    138KB

  • MD5

    2f73fdfb8140276968f2c1b358e5edf0

  • SHA1

    160ec42cd31c98fdd91c8a837be32757b2b9af92

  • SHA256

    5a45e4a32a4f2081b33dee2ab94eb3ebb4afafe0bd8f5b76e93dfe975c4a607c

  • SHA512

    65c2ac40557d94cf715d720a3774547f10253fe00071cd6e1824f6304f02187e26184b7c064e8c5d0526bd8650e5854bae283cb080ea17ef3d007f28b0d477f3

  • SSDEEP

    3072:+bvY5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/Yh:+bvwS7BqjjYHdrqkL/

  Score

  10^/10

  arrowratojg36cpersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral21behavioral22

• • Target

    arrow/5d573461fbe87a4441a12b5b61a3b74019aa21a784f9cf4410e1da100a55c792.bin

  • Size

    138KB

  • MD5

    7b2ec8aedfd42a95a5994dff19115471

  • SHA1

    f51aa65fc904272a1e344a57c436ba8632065b6c

  • SHA256

    5d573461fbe87a4441a12b5b61a3b74019aa21a784f9cf4410e1da100a55c792

  • SHA512

    1f5a313bf59129967db3e6f515edb364bde5c3d66c8cd67f27f79ff65cfdd8f982a68c3934e7574709ab71608c5d877d30f8ac8dc3986dd03523d8f6ad2caada

  • SSDEEP

    3072:2bvik5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/Y+:2bv5S7BqjjYHdrqkL/

  Score

  10^/10

  arrowratwq0csgpersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral23behavioral24

• • Target

    arrow/65403a8b9ecca912ea5cfa91aecdbe77c23e652e4c7465efded126c74711f65e.bin

  • Size

    138KB

  • MD5

    11b99c53b1e6030355af231a3a7fa65b

  • SHA1

    50b4a627dd808c1e332c2803286234f37e46bc2d

  • SHA256

    65403a8b9ecca912ea5cfa91aecdbe77c23e652e4c7465efded126c74711f65e

  • SHA512

    33a134c15708651e725daf0c834a01d970718f90109db275c38dbfd0501486c126d0566ab61cc55f4f47c3e7988483b7b445101b11388cff6399f4815ec63764

  • SSDEEP

    3072:KbvC5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/YP:KbvuS7BqjjYHdrqkL/

  Score

  10^/10

  arrowrat41iuhupersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral25behavioral26

• • Target

    arrow/8a3d555c8d1019b6d42721a2eea770d2101458fd70b208f6767db2eeb1cd44bc.bin

  • Size

    138KB

  • MD5

    d0488c635bdf39e3670bccb70e240ef9

  • SHA1

    3deb0acc0a9d72202e38d1afcae265d4671489d8

  • SHA256

    8a3d555c8d1019b6d42721a2eea770d2101458fd70b208f6767db2eeb1cd44bc

  • SHA512

    4370af21751cceffcbcdf37e9a6f36e404fd6eaab649e3dcb52a37fc0ee11c854539e08a711975f907b1c1ff577b9b13a659dfd0d008b089c26f85501e79a94f

  • SSDEEP

    3072:Obvt5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/YG:Obv7S7BqjjYHdrqkL/

  Score

  10^/10

  arrowrat21ltx5persistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral27behavioral28

• • Target

    arrow/a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.bin

  • Size

    2.2MB

  • MD5

    286de0123129cb1bdb0533301f435746

  • SHA1

    28887e5a7c28661db7b3d4da3612bafd05604813

  • SHA256

    a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71

  • SHA512

    07da8387eeffada23d39eed1390972e37031ea72a2f8a046027ac160f8ecef81ba3011698dac5fafc5114fe688796b1bc7c4df8a283dc1e23f76f0a2faf0b0bc

  • SSDEEP

    49152:IhgaZCojYG3CmQYbfHxDJ6aiyc7jntoe:IhggwdY7d0tV

  Score

  10^/10

  arrowratclientpersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral29behavioral30

• • Target

    arrow/b20df532e15674feb9da8728664caa14c6447f4473f2d64f6052de6af0737b3f.bin

  • Size

    158KB

  • MD5

    4952a2b2bd5b557db6798946e03b8264

  • SHA1

    80689d4742b237456dbaf2f5129a9452d18a02b4

  • SHA256

    b20df532e15674feb9da8728664caa14c6447f4473f2d64f6052de6af0737b3f

  • SHA512

    363178c39a43c7048a264a9d6aa0f64bc25a3b4ab752dd411dac40eef4acdec309d11ade25c6ae3e3ef50398d35ac36cecc302582ace0fd2b34b471e1f0b0bcd

  • SSDEEP

    3072:VbRJ+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfPl8a8Y:VbR80ODhTEPgnjuIJzo+PPcfPt8

  Score

  10^/10

  arrowratclientpersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral31behavioral32