Extracted

• • Target

    0d765dc413009ddb31ab0685ee4eb1a1dd9e68d415c0f75df36fd08c195bc216.exe

  • Size

    158KB

  • MD5

    7ab781bc4eaef1e1dc3d04fffe3fb893

  • SHA1

    96a304b8b5f50a3666ee41d212771cb7b71abea7

  • SHA256

    0d765dc413009ddb31ab0685ee4eb1a1dd9e68d415c0f75df36fd08c195bc216

  • SHA512

    e53b4cb0621e673c06dd84d89e1dd7161e91f062415ae0cbf52e40e61213bdc1aa238b66f31b14d826716848dbb20f8a6dd68a970ca83f63c4110d0e186ea542

  • SSDEEP

    3072:TbziH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfPoFO8Y:Tbzie0ODhTEPgnjuIJzo+PPcfPoo8

  Score

  10^/10

  arrowratr00tpersistenceratdiscovery

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2