Extracted

• • Target

    Client.exe

  • Size

    158KB

  • MD5

    fbe2de3a8f343b1e923a8f5176f1fcf3

  • SHA1

    9bf0f79d9110d7580be60da0d574863411074c92

  • SHA256

    151e25188fd745e3018605af4df7da77bc6cb5bd105978e667a371662646a288

  • SHA512

    225727fc2b982494b7644a1301367aa17be10c2f1c696df200bc8543805fbf44e2a3a266fc961917fc963fce43d9c7bee6b72d3d89c5565c770e30bcfa2839d7

  • SSDEEP

    3072:TbzGH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfP6OO8Y:TbzGe0ODhTEPgnjuIJzo+PPcfP6B8

  Score

  10^/10

  arrowratclientpersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2