Extracted

• • Target

    040cef4a919bf259e750029187dcfeff8b4b8f18e6a65cb401ee941d7999dd51.exe

  • Size

    158KB

  • MD5

    d89a424f932b8a69a4657e7ec09944da

  • SHA1

    7e1b1c99d1bc8fdbc8173ca9eda77dd2f4fd287c

  • SHA256

    040cef4a919bf259e750029187dcfeff8b4b8f18e6a65cb401ee941d7999dd51

  • SHA512

    459d3531c2f72637c99cd484f555a558f3aafc8e1d967e2333470863310d34fdfae8f0da3a7f20672e9040aaf2b2be3b3d6195dc6aaf0b9a53d28a40aa4282fe

  • SSDEEP

    3072:qbz+H+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfPoKO8Y:qbz+e0ODhTEPgnjuIJzo+PPcfPo18

  Score

  10^/10

  arrowratclientpersistenceratdiscovery

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2