Extracted

• • Target

    e659861670260fa5252d5315d71466659e321a90a357aa3005304f145c4a2027

  • Size

    300.0MB

  • MD5

    135b97e053b660f8e6cacd58965b93cd

  • SHA1

    828e92ad30ac243ec063252a338519e4429940e3

  • SHA256

    e659861670260fa5252d5315d71466659e321a90a357aa3005304f145c4a2027

  • SHA512

    6b19d2143f021feeccf5833b57fff55fbae3c72ea0eb480a893b48acd9ce2bdb0c895cd3516133436b4e937f97ee4e42ce58b4aa3729d1f3c29fa837bc19366c

  • SSDEEP

    12288:VD9TFmMwfrck/YEwEVhftq6rmIGD9P5X5U4LVkYdS7Ffi:KgERVNQ6Fq9hX5U4L94Zi

  Score

  10^/10

  arrowratclientdiscoverypersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2