Extracted

• • Target

    Client.exe

  • Size

    158KB

  • MD5

    e3341ad596ed6da038c798b1fee80556

  • SHA1

    35605ab4ac5b1dc51d833dc7175d6d0799868989

  • SHA256

    f2da736864510afba0fde1579316395f4566408d14f7aaac6776feee79cbf589

  • SHA512

    4a56f3af287723358a402024fbcfee23a6160e470c853c93473a7343687d19698cfb87d600b68209d58a1329413cd2b2200e571470b130ce832ab69dae80530e

  • SSDEEP

    3072:hbzIH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfPtqO8Y:hbzIe0ODhTEPgnjuIJzo+PPcfPtV8

  Score

  10^/10

  arrowratclientcredential_accessdiscoverypersistenceratstealer

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1