Extracted

• • Target

    6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090

  • Size

    138KB

  • MD5

    348c70b182eb53d74fe080f57c7265bc

  • SHA1

    42e3e7c848fc8774dd7bd6be1e3bdfe98fc86e06

  • SHA256

    6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090

  • SHA512

    3b2c3f04443e76371fdd03aae0b4c846bcf585ad69d235ff595612f24a96607b7c44b5182a66c87b589044a5d3b2b77839c384b5ccc7fc65b8b10c40982ada12

  • SSDEEP

    3072:Jbvs5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/Yl:JbvES7BqjjYHdrqkL/

  Score

  10^/10

  arrowratbrasilpersistenceratdiscovery

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Arrowrat family

    arrowrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2