Extracted

Extracted

• • Target

    JKKHJKHJKHJ.exe

  • Size

    63KB

  • MD5

    36a2e6b4dea8833ac9642279cc0f2f51

  • SHA1

    c646179ba316daabb09406d3705a4f4248b5e0a9

  • SHA256

    870a1845baec61018280036e11dc9bdea8de069760fe0a713395c6258a496e61

  • SHA512

    27eb6c352ccb66de04a45b1961e872a6c4a1e88faedd8480c81e319bc8c9c63ff48849b8fbba05efc21d64d1b79f761442f5a765b2e40fe5b28c1c860fe16602

  • SSDEEP

    768:Ns02C46poI3iPgqUiz9JmoAk25GV6iB1+E0Smv7mqb2ntpwH1obC9johPGKDpqKX:nEIoRp2erBlibbwwAGKDpqKmY7

  Score

  10^/10

  arrowratasyncratvenom clientsvenomhvncpersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies WinLogon for persistence

    persistence

  • Async RAT payload

    rat

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2