Extracted

• • Target

    72cabad77d69e7701af2d31218ac4b7e.bin

  • Size

    158KB

  • MD5

    72cabad77d69e7701af2d31218ac4b7e

  • SHA1

    e781c9c87a30163cdef9b5f6f419c27f26e8f271

  • SHA256

    7f8cb35c0290b33bcb49876680340b63061a3fc1558c372a42d87ec21c03ed66

  • SHA512

    709ad82ff09dc32dac22e8aa431833b885f8df4a2e61279fde90b7dad771d55b9a318372d645b8538dee0fdb4aeaed36c1408be00f27c102734aad8bb83a067c

  • SSDEEP

    3072:LbzQH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfPjBO8Y:LbzQe0ODhTEPgnjuIJzo+PPcfPjM8

  Score

  10^/10

  arrowratclientpersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2