Extracted

• • Target

    222.exe

  • Size

    158KB

  • MD5

    33f8a804c6a9d56f967e800fa70b1f2a

  • SHA1

    9d36c0fed1bc6ba0c3ef38531c5ae244d96b4324

  • SHA256

    4d7043e2fd82d12352a29ae4d80a6ad1fc32c31f0e09c5d0404ecbd5595235d0

  • SHA512

    5888d7395a60f80b95449c851f171b9d9deaba00a37cc79b952b7fd5f02faf0090742ce5e8bcb71998f97819cedf40d8014bd943df9e8fabfa79804b8fdd7c64

  • SSDEEP

    3072:LbzpL+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfP20O8Y:LbzpC0ODhTEPgnjuIJzo+PPcfP2z8

  Score

  10^/10

  arrowratclientpersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1