Extracted

• • Target

    ClientH.exe

  • Size

    90KB

  • MD5

    5558467d200c00a5acab51d4a9ca98dd

  • SHA1

    f9d50c3556451b056deb0950b6bdd4c3ecbb570f

  • SHA256

    213452a323be1617cfa62abeae43d873bec1e5c740aa2177e157a9772a92f231

  • SHA512

    80167cbf7301726ef6a1fd8f2c91db4076f5f5c869338953b1dacc88bf7f82e7caadabbbf32ecda3327c1be4c9da2477a198123a9ac1acf114f03c64bada3921

  • SSDEEP

    1536:ebRiQMhQ57SK3bUzZdQ1iIMvnZlbLxjV3AGq5gWlocT1wzySsd9NJ33p:ebRF57SKsstcnZTJQDgWPaySsdH5Z

  Score

  10^/10

  arrowratvenomhvncpersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies WinLogon for persistence

    persistence

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2