Extracted

• • Target

    file.exe

  • Size

    158KB

  • MD5

    1a6204ba18ed28ba84ae8a3299602bc8

  • SHA1

    ca32927f6e8d86e326fda075f096b16fae482c88

  • SHA256

    90093c647c4ef8f612e3e470c93debfb667aaf39073cd503cd670c6355dc474a

  • SHA512

    375d332c572066e9296b8f87a0bf62309db02f6f82dc91c300099e3d7e3a004a9987b88c58ff1114fcf6588d960ef41b296eaed69db1a5cc0b8b78c7f546641c

  • SSDEEP

    3072:gbzZDH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfPjSO8Y:gbzZDe0ODhTEPgnjuIJzo+PPcfPjN8

  Score

  10^/10

  arrowratclientpersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2