Extracted

• • Target

    Client.exe

  • Size

    158KB

  • MD5

    ddd78d5b177c9515d2e8fb3e2c0d3ca2

  • SHA1

    cfac443e8eaf2b855a109a53ac1cdd041bbb64d1

  • SHA256

    35d8f56cdb6c9a6b6ddbc00374a69a147f691d6640f7c199199d321bf1ec6923

  • SHA512

    d6e2793bca32d98a1ec3be6b82d2f7c2225ed756cb3761d6b921588b99bd6e7fefa261fdc16907074e8f23be96563bc9c94b148e8f23425760d3d955139227eb

  • SSDEEP

    3072:abz7H+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfPbSO8Y:abz7e0ODhTEPgnjuIJzo+PPcfPbN8

  Score

  10^/10

  arrowratclientpersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1