Extracted

• • Target

    869e6e56d6c9849420442213a468c9fc

  • Size

    138KB

  • MD5

    869e6e56d6c9849420442213a468c9fc

  • SHA1

    4f7e64126cd4adf324ee989ffa1efb5870178074

  • SHA256

    9f46555944110c0b982e05620a58e6a3828fa6ad8e8dd8f55894e25150207a5e

  • SHA512

    db12472b8d74c6f0feafc52d0233f725561de54c6d23687f48b5d8a16c211c20f4abf6bc8057246cc048c958f15f921dff664af49e0c9bb18911839a47ac0a85

  • SSDEEP

    3072:Kbvr5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/Yd:Kbv9S7BqjjYHdrqkL/

  Score

  10^/10

  arrowrat5t74s3persistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1