Extracted

• • Target

    abf2dcd61f4a9717e372e32dcfcb02831e51130f4a91fa87bb7954785db435fd.unknown

  • Size

    457KB

  • MD5

    5ff1aded34d5d6f0635f6f9861436886

  • SHA1

    d798ff38d279754353ee88ff35bf46a87dc75484

  • SHA256

    abf2dcd61f4a9717e372e32dcfcb02831e51130f4a91fa87bb7954785db435fd

  • SHA512

    b3d6b951c3130e8a834744cbebc78208b9e1393517ca40e4e3a5bdf391cb1c05c4a23ee88aaac61b1be5a163811069d97ecfdf372457607cc3716ea11a6d8402

  • SSDEEP

    6144:6VDFV/A8nNKmbcRTUufYbE6N4tDeaBfLo1sHsl9yS/M0HixBNqrpB92bMDsA4nx2:snND98MDL

  Score

  10^/10

  arrowratclientrat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2