Extracted

• • Target

    Client.exe

  • Size

    158KB

  • MD5

    b0e4bd2a0ae239b56802a213e420d374

  • SHA1

    7cb945ab693f92094031f99274ce58b5887e54cc

  • SHA256

    b3a46d84a821e762923de3ea33e408018c73d739e2ebf10a411f2eddaaff17f1

  • SHA512

    da7fd77f9c460e06ca28e97a198a9ba02adda1437daba08c1fd7c5e4456b6ad8d88d4a0ef581e7adf0ba65c686dcfbdd8c3ee0ef4929aa00ab1010866fd640f1

  • SSDEEP

    3072:gbzDDH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfPiSO8Y:gbzDDe0ODhTEPgnjuIJzo+PPcfPiN8

  Score

  10^/10

  arrowratclientcredential_accessdiscoverypersistenceratstealer

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies WinLogon for persistence

    persistence

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1