Extracted

• • Target

    MOQ_T7FIBA00541·PDF .scr

  • Size

    670KB

  • MD5

    48a5e2b45923213e94a82d30db1eb988

  • SHA1

    eb3c3aeb61e6e20b149cbd966f60c81a8215e8b0

  • SHA256

    19fa9896468d7dd79d76fa27b34f66e13b6c5268cdd574c0a78eeb0e3dbeb839

  • SHA512

    13edc7b141a8bd854a07ec70371f6fe59055d1dfe4127e3912992181d983e710f990d0cfcaa294e5da8e37ab757efb93133382625e210c47823885586fc536da

  • SSDEEP

    12288:PBzhfOS3GXJNUwCpoOekXOS6zjwehALsCGlhcBd:phfOS3sJWwvOeYCras

  Score

  10^/10

  arrowratclientpersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    ORDER LIST_SEPT7FIBA00541·PDF.scr

  • Size

    670KB

  • MD5

    48a5e2b45923213e94a82d30db1eb988

  • SHA1

    eb3c3aeb61e6e20b149cbd966f60c81a8215e8b0

  • SHA256

    19fa9896468d7dd79d76fa27b34f66e13b6c5268cdd574c0a78eeb0e3dbeb839

  • SHA512

    13edc7b141a8bd854a07ec70371f6fe59055d1dfe4127e3912992181d983e710f990d0cfcaa294e5da8e37ab757efb93133382625e210c47823885586fc536da

  • SSDEEP

    12288:PBzhfOS3GXJNUwCpoOekXOS6zjwehALsCGlhcBd:phfOS3sJWwvOeYCras

  Score

  10^/10

  arrowratclientpersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4